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SMALL BUSINESSES TO GLOBAL 
CORPORATIONS: WILL THEY SURVIVE 
THE YEAR 2000? 


WEDNESDAY, OCTOBER 7, 1998 

U.S. Senate, 

Special Committee on the Year 2000 

Technology Problem, 

Washington, DC. 

The committee met, pursuant to notice, at 9:30 a.m., in room 
SD-192, Dirksen Senate Office Building, Hon. Robert F. Bennett 
(chairman of the committee), presiding. 

Present: Senators Bennett, Smith, and Collins. 

OPENING STATEMENT OF HON. ROBERT F. BENNETT, A U.S. 

SENATOR FROM UTAH, CHAIRMAN, SPECIAL COMMITTEE ON 

THE YEAR 2000 TECHNOLOGY PROBLEM 

Chairman Bennett. The committee will come to order. I have 
just received word that we have two stacked roll call votes sched- 
uled starting at 10 o’clock. I have said before, somewhat face- 
tiously, the Senate gets in the way of the work of the Senate from 
time to time. We apologize in advance to our witnesses for the dis- 
ruption that might come as senators will have to leave to go to the 
floor to cast these votes; we are very grateful to all of the witnesses 
for their coming and being with us today at this hearing on the 
general business sector. 

This is the committee’s ninth and final hearing this year, and in 
every one of our hearings we have strived to increase awareness 
and disseminate reliable preparedness information as well as facili- 
tate solutions. I believe we have done that. In spite of the efforts 
of the committee, however, recent polls say that only 30 percent of 
Americans have even heard of the Year 2000 problem and that is 
a little disquieting. There are now 450 days between us and the 
new century so that the work of this committee and everyone con- 
nected with this problem becomes more urgent with each passing 
day. 

Now we have gone through the top priorities that the committee 
laid out at the outset starting with the power grid going through 
telecommunications and so on. So we come to general business ac- 
tivity and just because it comes after some of these other vital in- 
frastructure priorities does not mean that it cannot have a major 
impact on what happens in the Year 2000. “General business” is 
the term that encompasses the spectrum of American commerce 
from over 5 million small firms at one end to global corporations 

( 1 ) 
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at the other end. Every one of these companies in one way or an- 
other faces a Year 2000 challenge — from the PC on which you keep 
your books all the way up through the systems that automate of- 
fices, credit card point of sale systems, and just in time inventory 
systems. 

One of today’s witnesses will warn us that over 700,000 small 
firms are at risk of closing their doors or being severely crippled 
by Year 2000 problems. So the awareness challenge that we have 
taken on this committee is still very necessary. Now global corpora- 
tions face complex problems because of their dependence on thou- 
sands of suppliers, distributors, and frankly customers; a customer 
can have a problem that can kick back into your corporation in a 
variety of ways. These problems are both domestic and inter- 
national. Businesses must be concerned not only about Y2K readi- 
ness of their partners but the infrastructure of the companies in 
which they reside. Perhaps in next year’s hearings I will focus 
more on international problems and move in that direction. 

Today, the Gartner Group is releasing some alarming new re- 
search data which shows that 66 percent of the companies in criti- 
cal industries such as health care and food processing will likely 
experience at least one mission critical systems failure. In addition, 
50 percent of the companies in critical trading partner countries 
such as Germany, Japan, Saudi Arabia, and Venezuela will experi- 
ence similar failures, and if these predictions are correct and noth- 
ing is done in the 450 days remaining, Y2K could deliver a dev- 
astating blow to an already troubled global economy. 

If I sound overly serious, it is not because I am grabbing for the 
headlines but because I am hoping to reach people who are cur- 
rently unaware of where they are. It reminds me of a paraphrase 
from the poem by Rudyard Kipling: If you can keep your head 
when all around you are losing theirs, you do not understand the 
situation. [Laughter.] 

[The prepared statement of Chairman Bennett can be found in 
the appendix:] 

Chairman Bennett. Now, before we hear from our witnesses I 
would like to recognize Senator Collins for any opening statement 
that she might have. I would also comment that her colleague Sen- 
ator Olympia Snowe, who has been part of this effort even though 
she is not a member of this committee, has a statement that she 
would like included in this record. She has held a number of hear- 
ings around the State of Maine on small business issues and so it 
is appropriate that her contribution to the committee would be in- 
cluded. 

[The prepared statement of Senator Snowe can be found in the 
appendix.:] 

Chairman Bennett. Senator Collins. 

OPENING STATEMENT OF HON. SUSAN M. COLLINS, A U.S. 

SENATOR FROM MAINE 

Senator Collins. Thank you very much, Mr. Chairman. I want 
to first thank you for your continued leadership on this critical 
issue. Over the past 4 months, this committee has examined vital 
areas of our country’s technological infrastructure. We started in 
June with our utilities hearing, and since that time the committee 
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has focused on telecommunications, banking and finance, transpor- 
tation, and most recently emergency preparedness. But of all the 
hearings that we have held, today’s hearing with its focus on Y2K’s 
impact on business, especially the impact on small business, might 
well be our most important endeavor to date. 

Our Nation’s 23 million small businesses create 2 out of every 3 
new jobs, represent over 90 percent of all employers, and are re- 
sponsible for more than half of our nation’s technological innova- 
tion. In my home State of Maine, they are truly the backbone of 
our economy. While we have received assurances of other industry 
sectors’ preparedness for Y2K, there is considerable concern about 
the small business sector. Many small businesses are having dif- 
ficulty in determining how they will be affected by Y2K and what 
they should do about it. Many of them face not only technological 
but also financial challenges in becoming Y2K compliant. Most of 
all, they simply need practical information about what to do. 

The good news is that information resources are available for 
small businesses to assist them in figuring out what to do. In fact, 
I look forward to welcoming two people who know how to help 
small businesses and are working everyday to tackle the Y2K prob- 
lem. First, I want to welcome Fred Hochberg, the Deputy Adminis- 
trator of the SBA, an organization with which I am very familiar 
because I served at one point as the New England administrator 
of the SBA. The SBA joined Senator Snowe, as the chairman has 
mentioned, in Maine in August to roll out the agency’s “Are You 
Y2K OK?” program which encourages small businesses throughout 
the country to identify potential Y2K problems, take action on 
them, and stay informed about new developments. This is an excel- 
lent outreach program and I want to commend SBA for its leader- 
ship role on Y2K. 

I also am especially proud to welcome Rod Rodrigue from Maine. 
I had the opportunity to meet with Rod last month in my office and 
was impressed by the tremendous amount of knowledge and energy 
he brings to this issue. Thanks to his leadership, the Maine Manu- 
facturing Extension Partnership has taken the initiative in my 
State in reaching out to small businesses to help them cope with 
the Y2K challenge. 

The Maine Manufacturing Extension Partnership uses a diag- 
nostic software tool to assist businesses in identifying specific Y2K 
problem areas and then provides a road map for businesses to find 
further information to help them with the Y2K remediation process 
including links to SBA loans if necessary. I believe that Congress 
should take a very close look at this model which is funded through 
the National Institute of Standards and Technology as well as the 
Department of Commerce. 

Mr. Chairman, by their very definition, entrepreneurs are risk 
managers. In the years that I have been working with small busi- 
nesses and based on my own family’s 150 years of continuous oper- 
ation as a small business, I am very aware of the countless experi- 
ences where the entrepreneurial spirit has propelled small business 
owners to overcome major obstacles to succeed. 

While we hear about the reasons for concern about small busi- 
nesses and their ability to cope with Y2K in today’s hearing, we 
should not lose sight of their amazing and continual ability to 
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adapt to changed circumstances. Coupled with tools and resources 
from organizations like the SBA and the Maine MEP, it is my ex- 
pectation that small businesses will, in fact, succeed in solving the 
Y2K problem. I look forward to learning more from today’s wit- 
nesses about how the Federal Government can assist them in meet- 
ing this goal. Thank you, Mr. Chairman. 

[The prepared statement of Senator Collins can be found in the 
appendix.] 

Chairman Bennett. Thank you very much. We have divided up 
the responsibilities in the committee according to the seven prior- 
ities that we outlined and the seven members of the committee. 
Senator Smith, who is himself a small businessman — actually his 
business has grown quite large, has led the committee on this 
issue. [Laughter.] 

During my first campaign, I was accused of being a big business- 
man, and I said, well, I did not start out that way. [Laughter.] 

But I am not going to give it back. This particular assignment 
of dealing with general business Y2K problems has been given to 
Senator Smith and he has responded very well and we appreciate 
his leadership and help on this. Senator Smith. 

OPENING STATEMENT OF HON. GORDON SMITH, A U.S. 

SENATOR FROM OREGON 

Senator Smith. Thank you, Mr. Chairman. I appreciate being 
able to work with you and the excellent leadership you have given 
in addressing this Y2K problem. I also want to thank our distin- 
guished witnesses who are with us today for taking time to help 
us address the challenges facing the entire business sector at both 
the large and small ends of the scale. 

With American business today becoming more and more depend- 
ent on technology, I hope this hearing will be a stepping stone for 
all small businesses to inch closer to full preparedness for the Year 
2000. Those most at risk for the Y2K failures are small and me- 
dium-sized companies, not their larger counterparts. Many small 
companies have not yet realized the extent to which the Y2K com- 
puter problem will affect their businesses and may not have access 
to capital to cure such problems before the Y2K issue causes them 
disastrous effects. 

This is why it is so important for the Federal Government to 
both raise awareness of the problem as well as find emerging solu- 
tions. In my former life, as the chairman mentioned, I was a food 
processor. I called myself a pea picker from Pendleton, OR and 
owned a small frozen food processing plant. I can assure you that 
any interruption within the farm to fork chain can result not only 
in direct loss to those who supply food but will likely translate into 
food shortages and price increases nationwide. 

As with many businesses, food suppliers are increasingly depend- 
ent on computerized processing and information exchange. For ex- 
ample, farmers and ranchers use electronically equipped irrigation 
systems, animal systems and transport systems. Food processors 
rely on automated systems that help prepare and package con- 
sumer ready products. Distributors, wholesalers, and retailers de- 
pend on computer-driven equipment to transport, deliver, store, 
display, and sell food products. Inventory and accounting systems. 
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harvesting equipment, grain elevators, refrigeration and security 
systems all depend on the computations of computers. Mr. Chair- 
man, I know that there was some difficulty in getting some of our 
larger retailers and food processes to participate today, but I am 
happy to report that we will hear from a representative of one of 
Oregon’s food companies and they have been working very hard on 
the Y2K issue. 

I am proud to introduce Harold Schild, the president and CEO 
of Tillamook County Creamery, who is one of our witnesses today 
from Tillamook, OR. If you all have not tried Tillamook cheese and 
ice cream, it is the best in the world. No offense meant to any of 
my Wisconsin colleagues. 

Chairman Bennett. We will take you to Cash Valley. [Laugh- 
ter.] 

Senator Smith. I look forward to hearing Mr. Schild’s testimony 
to address the real problems with which typical small business is 
confronted and specifically the food industry in its approaches to 
addressing the Y2K problem. Another company from Oregon, 
Norpac Foods, has also been leading the effort in addressing the 
Y2K problem in the frozen food business. While their representa- 
tive is not here today, Mr. Chairman, they have provided a state- 
ment that is very helpful and insightful, and I ask that that be in- 
cluded in the record. 

Chairman Bennett. Without objection. 

[The prepared statement of Norpac Foods can be found in the ap- 
pendix.] 

Senator Smith. I am also pleased that the Deputy Administrator 
of the Small Business Administration, Mr. Fred Hochberg, is here 
before us today. The SBA has been one of the leading Federal agen- 
cies actively raising public awareness for Year 2000, and I would 
like to commend the agency for its aggressive outreach programs 
to small business. I know my constituents in Oregon have found 
the SBA website a very useful and informative tool. 

Mr. Hochberg, I am interested in your opinion regarding the re- 
cent legislation passed by the Senate Small Business Committee 
that requires SBA to establish a Y2K loan program. I understand 
this loan program would establish a new short-term loan program 
under which the SBA would guarantee up to 50 percent of the 
value of private sector loans up to a total loan value of $50,000 for 
small businesses to become Y2K compliant. So your views on that 
I am interested in. If you or any of the witnesses can testify on the 
impact this legislation will have, it will be helpful to all small busi- 
ness. 

As we work toward addressing the Y2K problem, let us not forget 
that many of our international neighbors are still very far behind. 
We need to continue to encourage foreign countries to focus on the 
impacts of Y2K since it could potentially shut down an entire coun- 
try. With this in mind, I look forward to hearing more specifics on 
Y2K challenges facing our small businesses and our global corpora- 
tions and, Mr. Chairman, I thank you. 

[The prepared statement of Senator Smith can be found in the 
appendix.] 

Chairman Bennett. Thank you very much. Now, before we get 
into the subject of today’s hearing specifically, I would like the 
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members of the committee to meet one of my constituents, Laurene 
West, who is a registered nurse from Salt Lake City, UT. Her spe- 
cial medical circumstances graphically demonstrate that the Y2K 
problem is not just a technological problem or a business problem, 
but can be a very personal one. This very capable and articulate 
woman is living proof that the Y2K problem has potential to take 
a very serious toll. And she has courageously agreed to share her 
story with us. So I would ask her to come forward and be our first 
witness this morning. Even though it is not specifically on the issue 
of small business, I think you will find it very worthwhile. Ms. 
West, we welcome you and again we thank you for your willingness 
to share what must be a very difficult personal odyssey with us, 
but I think the committee and those who are watching on tele- 
vision and elsewhere will be greatly benefitted by your willingness 
to do this and we are grateful to you. 

STATEMENT OF LAURENE L. WEST 

Ms. West. Thank you. Senator Bennett. Can you hear me? 

Chairman Bennett. Yes. If you could get a little closer to the 
microphone. These microphones are not going to be threatened by 
Y2K problems. [Laughter.] 

They are low enough tech and old enough that they are not a 
problem. So if you could get it as close to you as you can, we would 
appreciate it. 

Ms. West. Thank you. I appreciate the invitation to present to 
you my concerns and my health history. Seated before you this 
morning, I probably give the impression that I am good health. I 
am not. Without a daily supply of medication and a coordinated 
community effort on the part of the health care community, I will 
be a casualty of the Year 2000; I will die. 

I had a tumor removed from the center of my brain, and I now 
require daily medication to prevent the tumor from returning. Ad- 
ditionally, when I had the first of 13 surgeries on my head, I ac- 
quired a staph infection which now requires — the infection that I 
have in my head is not sensitive to any known oral antibiotic. 
Therefore, I am dependent on a continual supply of IV antibiotics. 
I am a registered nurse. For 20 years I worked in critical care set- 
tings of acute care facilities, and for the last 14 years I have 
worked with developing and implementing medical information sys- 
tems. I share that with you so that you know or that you under- 
stand that I know health care. I know it from being a clinician. I 
know health care also from being a recipient of care and I know 
how the Year 2000 will affect health care. 

My message today is twofold. First as a clinician, we have all 
heard the media reports about what the Year 2000 will do to the 
power grid, national security, air traffic. All hospitals are at risk 
if we do not have power, but I can bring an army of clinicians into 
any facility and keep patients alive basically by doing CPR, but I 
cannot keep patients alive if I do not have a continual supply of 
their medications. 

My second message is that all Americans will be affected by a 
disruption in the supply and distribution of medications, particu- 
larly those of us who are alive only because on a daily basis, I take 
drugs to keep my tumor from growing and to keep the infection in 
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my head from spreading. And what I find amazing is that my 
medication requirements are minimal compared to those of dia- 
betics, transplant patients, patients with implantable devices, pa- 
tients who have hypertension, who have cardiac difficulties. Those 
people have no time if they do not have access to their medications. 

We need to begin immediately to create a public awareness pro- 
gram. We need to teach the people of our country what they can 
do to prepare. AARP needs to know. They need to talk to their 
membership and let those people know that they are going to have 
a store of their medications. They need to stockpile their medica- 
tions. An informed and educated public will be less likely to panic, 
but we will have panic if we have people out there who think that 
they cannot get access to their medications, many of which are con- 
trolled substances. 

All medication dependent Americans are looking to you for help 
in mobilizing national resources to help us survive. I will be happy 
to help in any way that I possibly can. Let us work with the 
RX2000 Solution Institute, the American Medical Association, the 
American Nurses Association, Department of Insurance, AARP, 
International Red Cross, any other Federal resources that we have, 
to prepare a coordinated national preparedness program so that 
the Year 2000 does not cause unacceptable deaths. 

We may need legislation allowing a one-time exclusion for either 
Medicare, Medicaid or any other health plan to allow patients to 
get a 90 day supply of their medications at the end of 1999 instead 
of just a 30 day supply. We would then need to come up with a cre- 
ative process to distribute and store controlled substances and ra- 
dioactive isotopes. We need to work with the CDC, the Centers for 
Disease Control, to prevent global epidemics from the lack of anti- 
biotics and immunizations. 

We should compose a national patient advocacy council to mon- 
itor Year 2000 efforts within all health care organizations and pro- 
vide patients and health care providers a media where they can 
turn, where they can look for help, where they can get answers. 
And if worst case scenarios occur and health care is rationed, the 
public needs to know which diagnoses and which procedures will 
be covered. 

Thus far, most health care organizations are taking the position 
that they can reduce their liability exposure by minimizing their 
due diligence and their education. That may be politically correct 
and legally correct, but I do not consider that to be ethical. If we 
do not teach the patients what they need to do, we will die. There 
is no harm in overreacting to this issue. There is harm if we do 
not react. 

I am willing to do whatever I can to help in any way to save as 
many lives including my own as possible. And my story is not 
unique. There are millions of people who are at greater risk than 
myself who need your help. And for them and for myself I am ask- 
ing for your help. Thank you. 

[The prepared statement of Ms. West can be found in the appen- 
dix.] 

Chairman Bennett. Thank you. May I ask you a question or 
two? It is my understanding that your medication is sufficiently 
unusual that you require a very careful calibration that involves 
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medical devices that are something other than just pills sitting on 
a shelf; is that true? 

Ms. West. To keep my tumor from regrowth, there is an oral 
medication that I take. My risk is with infection and in order to 
receive the IV antibiotics, those are at such a high concentration 
that in order to receive those, I have a catheter that is inserted 
into the antecubital vein of my arm and then threaded up into the 
superior vena cava of my heart, and you can only do that under 
sterile circumstances. 

Chairman Bennett. But the calculation of the dosage requires 
devices 

Ms. West. That is correct. 

Chairman Bennett [continuing]. Which could fail because of 
Y2K? 

Ms. West. That is correct. 

Chairman Bennett. I wanted to make that clear so that every- 
body understood it is not just a matter in your case of stockpiling 
90 days worth of pills. The device that controls this daily injection 
must be absolutely on in terms of its calibration and its accuracy 
or you would not survive a couple of days. Is that 

Ms. West. That is correct. 

Chairman Bennett. I do not mean to overdramatize it, but your 
delivery seemed a little cool, and I wanted everybody to understand 
exactly how serious the calibration issue is in your case and how 
vulnerable you are to a Y2K failure. 

Ms. West. And there are patients who are at much greater risk 
than myself such as transplant patients and insulin dependent dia- 
betics. They have less time than I have and the calibration for 
their medication also comes from a device with a microprocessor 
and in many cases those medications cannot be stored. The medica- 
tion that I take for my tumor, I can store 6 months worth of that 
and then I rotate through that. The IV medication that I take for 
the infection in my head, I cannot store that for more than 2 
weeks. 

Chairman Bennett. Thank you for that clarification. Do any 
other members of the committee have questions? 

Senator Collins. I just want to thank you, Ms. West, for coming 
forward and sharing your personal experience. The fact that you 
have been both a clinician and a patient gives you an unusual in- 
sight to share with the committee. I wish you the best of every- 
thing and I really appreciate your taking this good out of your very 
difficult experience. 

Ms. West. Thank you. 

Senator Smith. I would just simply second that. Thank you for 
being here and others will benefit because you have shared your 
story. 

Ms. West. Thank you. 

Chairman Bennett. Thank you. You have helped us dramatize 
in a positive and I think worthwhile way the challenge of this. We 
were in a hospital yesterday. Senator Dodd and I, and some people 
connected with the health care industry have said to us this is not 
a patient care problem, this is just a computer problem where our 
billing system is at risk. We did our very best yesterday to make 
it abundantly clear this is first and foremost a patient care prob- 
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lem. Your being here today and your willingness to share your ex- 
perience with us has helped to dramatize that for any who still 
have not got the message. 

Ms. West. Can I make one more statement? 

Chairman Bennett. Surely. 

Ms. West. I am astonished that physicians, many physicians, 
and many hospitals are considering this to be an IT problem only. 
And at this point, there is not time for a complete electronic fix. 
Their only alternative is for physical contingency plans working 
closely with pharmaceutical companies, closely with biomedical de- 
vice manufacturers, to make sure that there is a continual supply 
or we will have large scale mortality rates in the Year 2000. 

Chairman Bennett. Our third panel will consist of a number of 
pharmaceutical companies. I know their representatives are in the 
room; that is one of the reasons why we asked you to be our first 
witness so they could hear this directly from you. Thank you again 
for coming and for sharing this with us. 

All right. We will now start with Lou Marcoccio from the Gartner 
Group, and he will set the scene for the hearing. His research is 
based on a network of some 15,000 companies in 26 vertical indus- 
tries in 87 countries. He will share the results of Gartner’s re- 
search into the impact of the Year 2000 problem on small, medium, 
and large companies and the relative Y2K preparedness of industry 
sectors within the United States. And he will also give us an up- 
date of the Y2K status of other countries closely connected with the 
U.S. economy. If Ms. West gave us a laser beam micro-view of the 
Y2K impact on one individual, Mr. Marcoccio will give us the 
macro view. In some cases, it is almost as scary. Have I pro- 
nounced your name correctly, sir? 

Mr. Marcoccio. Yes, you have. Senator, yes. 

Chairman Bennett. OK. Fine. We welcome you here and I apolo- 
gize in advance when the buzzer goes off. We will do our best to 
run over and vote and get back as quickly as we can, but we will 
get started. 

STATEMENT OF LOU MARCOCCIO, RESEARCH DIRECTOR, 
GARTNER GROUP 

Mr. Marcoccio. OK. Great. First of all, thank you, Mr. Chair- 
man and members of the committee, for having me here this morn- 
ing to share this information with you and this important research 
that we have been working on and pulled together in regard to the 
scope and status and risks in regard to Year 2000 throughout key 
industries and throughout the world. 

In developing our research at Gartner Group for those who do 
not know, I would just like to make a comment here that we do 
our research in several ways. We have tens of thousands of clients 
throughout the world that we work with everyday in all industries 
throughout most countries of the world. We also do surveying of 
very large numbers as. Senator, you mentioned, of 15,000 compa- 
nies in 87 countries including the country governments and their 
agencies as well as far as status and specific risks related to those 
specific companies and government agencies. 

One of the things that we find is that first of all throughout 
1998, there has actually been tremendous progress and, in fact, in 
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1997, in calendar year 1997, about 5 percent of information tech- 
nology budgets were spent on average on the Year 2000 problem 
and on Year 2000 projects. In calendar year 1998, that has in- 
creased by six times, and during calendar year 1998 the companies 
that have started and government agencies that have started on 
this problem are spending an average of 30 percent of their infor- 
mation technology budgets. Unfortunately, we have not seen as 
much of an expansion in other areas outside the IT area. We see 
now about 30 percent of companies that had previously started on 
Year 2000 in calendar year 1997 have expanded these efforts into 
other areas of business, areas of contingency and other areas of in- 
tegration and interoperability between themselves, other countries, 
other facilities and so forth throughout the world. 

What we find in our information — basically we do our surveys, 
we do our measurement of companies and governments through a 
method that we call COMPARE. It has five levels I would just like 
to briefly mention so that you understand when I go through the 
actual status. These five levels include level I being companies that 
are basically just getting started. They are doing awareness. They 
are getting people or a champion to head up the activity within a 
company, and they are starting to do their inventorying of both 
their IT systems and also their key business processes as well. 

In level II is where these companies basically complete detailed 
inventories of their business dependencies and the remainder of 
their IT components, embedded systems and other things that they 
at least can get their arms around and identify, which in many 
cases is a difficult task in itself. 

In level III these companies actually get detailed program plans 
put together, project plans, they get the resources identified, com- 
mitted and in place, and they start doing the work as far as actu- 
ally getting systems remediated and fixed and also doing a great 
deal of work as far as identifying dependencies and risks with ven- 
dors, supply chain vendors and other business dependencies. In 
level III, they also get 20 percent of what they identify as their 
mission critical systems fixed, tested and back into production envi- 
ronments within their companies. 

In level IV, they get the remaining 80 percent of those mission 
critical solutions fixed and back into production as well as complet- 
ing a detailed risk assessment and development of contingencies 
and alternatives in order to lower the risks enough in order not to 
have major business interruptions. 

In level V, they basically complete whatever else they have time 
to complete outside of mission criticality as well as putting proce- 
dures and policies in place to ensure that they do not bring in in- 
fected systems or other business processes after they get their sys- 
tems fixed. So those are basically the five levels. 

First of all, I would like to identify status associated with size. 
When we look at all companies and all government agencies 
throughout the world, we identify size in three categories. First of 
all, small is under 2,000 employees. We do have some subcategories 
as far as extent of size in the small category, but we identify small 
as under 2,000 employees. Medium or mid-size is 2,000 to 20,000 
employees. And large is over 20,000 employees. 
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What we find at the present time this quarter — in fact, as of just 
a couple weeks ago in our latest status survey — we find that small 
companies throughout the world in this under 2,000 employee cat- 
egory are anywhere from not started at all up to approximately the 
end of level II, which means that they have gotten some great ex- 
tent of their inventory completed. That is the range throughout the 
world as far as small companies. 

The mid-size companies run the range from between being about 
halfway through their inventory activities up to and including hav- 
ing as much as ten to 20 percent of their internal systems fixed 
and have started testing. So it is a pretty wide range on the mid- 
size companies as well. And the large companies, over 20,000 em- 
ployees, run the range from the end of level II, which means that 
they have basically nearly completed their thorough inventory of 
business processes as well as their internal IT systems, all the way 
up to having as much as 70 to 80 percent of their internal systems 
fully remediated and are well into the test phase. 

Now, this means if we were to look at actual timeframes, we find 
that it takes — and this is a pretty important fact to us — it takes 
an average of 30 months for a mid-size company or government 
agency to complete their systems, mission critical systems, that 
they identify as mission critical. That means that unfortunately it 
takes about 6 months under 3 years to get that kind of activity 
completed. That is from the time they start to the time they get 
their mission critical systems made compliant or at least remedi- 
ated, fixed, and back into production. 

Now that means that small companies, the difference between 
small companies and mid-size companies right now runs between — 
well, it is about IV 2 to 2 years difference between medium to large 
companies. So large companies are way out ahead of, of course, 
small and mid-size companies overall throughout the world. It is a 
IV 2 to 2 year difference between mid-size to large. And right now 
it is running 2 V 2 to 3 years between small to large companies. So 
large companies are considerably out in front throughout the world 
and especially here in the United States. 

Now, 23 percent of all companies throughout the world of all 
sizes, all industries, have not started as of yet on any Year 2000 
activities or efforts; 83 percent of that 23 percent are small compa- 
nies. That is what we categorize as small companies throughout 
the world. 

So understanding that by size, let us now take a look by indus- 
try. According to our latest survey, we find that the three indus- 
tries that are farthest out ahead are insurance, investment serv- 
ices, and banking. I think we are all somewhat familiar with the 
reasons why those industries are somewhat ahead. Basically, their 
mission critical systems were a lot more obvious up front or early 
on. In some cases these are the industries that are most regulated, 
and in some cases we have situations where these industries actu- 
ally experienced failures starting quite awhile ago. In fact, banks 
had failures in regard to processing 30 year mortgages back in 
1970 and so forth. So these are the industries that are farthest 
head. 

Chairman Bennett. They are also the industries that come 
under the purview of the Senate Banking Committee where Sen- 
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ator Dodd and I got started on this. In an election year where we 
are both up, we cannot fail but to take note of that. [Laughter.] 

Mr. Marcoccio. So looking at this same chart, you can see that 
some of the industries that are farthest behind unfortunately are 
like education, health care, especially health care as far as hos- 
pitals and elderly care facilities. The oil industry is surprisingly be- 
hind in these activities. Industries like semi-conductor, food proc- 
essing and agriculture, farming, construction industry, all of these 
industries are dangerously behind and if you look at our 30 month 
timeframe that it takes to get mission critical solutions compliant, 
they are dangerously behind in this situation. 

Senator Smith. Mr. Chairman, I notice that the lawyers are dan- 
gerously behind. Does that mean that business can sue their law- 
yers? [Laughter.] 

Chairman Bennett. I am sure some lawyers will figure out a 
way to sue other lawyers. 

Mr. Marcoccio. Yes. And we separated medical practices out of 
health care because we found such a stark difference. Medical prac- 
tices in general are extremely behind on this activity. We find a 
very small percentage have actually started any activity whatso- 
ever in addressing the problem. 

Next slide. The next item has to do with — excuse me. I am sorry. 
We are out of sync. We need to go back. There we go. Yes. OK. The 
next slide here we have categorized basically all of the industries 
and what we have been doing is we have actually been following 
failures for some time. We have put analyses together associated 
with being able to calculate predictions related to status, related to 
history of failures that have occurred in those industries and in 
those size companies, and we have been able to analyze and come 
up with a prediction associated with these four categories of indus- 
tries. 

As you can, the industries that are farthest ahead in category 1, 
we have now predicted that 15 percent of all companies in those 
industries will experience at least one mission critical system fail- 
ure. The industries that are in category 2, 33 percent, or approxi- 
mately one-third, of those companies in those industries will expe- 
rience at least one mission critical system failure. And, of course, 
a mission critical failure means that a business interruption is like- 
ly to occur. It could affect revenue and will likely affect the contin- 
ued operation of that business. 

The category 3, one half of all companies in those industries 
throughout the world will experience at least one significant mis- 
sion critical system failure. And in our last category, which is ex- 
tremely severe, we will have two-thirds of all companies in that 
category will experience at least one significant mission critical sys- 
tem failure. So these are clearly the industries that are at most 
risk and we have gone through subcategorizations in these areas 
to identify risks of various severity within these industries as well. 

The next item I would like to share is associated with status of 
countries — go on to the next major slide — the status — it is another 
one like that one. The status of countries we have been able to 
identify associated with where they stand and basically as you can 
clearly see the United States is definitely farthest out front when 
we include all sizes, all industries of companies throughout, and 
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government agencies at both the Federal, State and local level. You 
can see the United States is clearly out in front. We have other 
countries that are just slightly behind like Holland, Belgium, Swe- 
den; several of the western European countries are just slightly be- 
hind the United States. 

Now when we look at countries that are farthest behind, you can 
see that we have an anomaly in Western Europe where we have 
Germany very far behind. Germany has had a major focus on a 
new monetary euro system. They have also been a major driver of 
that strategy and in order not to lose focus on that activity or actu- 
ally lose focus on the activity, they have actually put very little ef- 
fort up until now associated with the Year 2000. It has only been 
as of late that many industries and companies in Germany are now 
starting to figure out that they need to address the problem and 
now they are scrambling to figure out how they can get moving as 
quickly as possible. We also have countries like Japan that are rel- 
atively far behind. 

Next slide, please. Now we have taken the countries as well and 
categorized them in four categories. And as you can see, we have 
been able to predict the percent of companies in each of these cat- 
egories as far as how many companies will experience at least one 
significant mission critical system failure, and you can see the 
countries in category 1 where we will have 15 percent of those com- 
panies — and again, this is all sizes, all industries — will experience 
at least one significant mission critical system failure. These in- 
clude countries like Australia, Belgium, Bermuda, Canada, Den- 
mark, Holland and so forth. 

The countries that are in category 2 where companies in those 
countries, 33 percent of them, will experience a significant mission 
critical system failure, and these include countries that many of 
our companies are well entrenched with. There is an awful lot of 
dependency on. Many are addressing markets in these countries to 
a great extent. Countries like Brazil, Chile, Finland, France, Hun- 
gary and so on. 

In category 3, 50 percent of companies and government agencies 
in those countries will experience a significant mission critical sys- 
tem failure. And, of course, in category 4 we are talking about two- 
thirds will experience the same. So you can see the probability and 
the extent of the problem here; the seriousness of the problem 
within these countries is extreme. We find in countries like Af- 
ghanistan, Bahrain, Bangladesh, Cambodia, Chad, China and so on 
and so forth, we have, first of all, very little effort going on at the 
government level within these countries, either local, regional or 
federal. And we also find that most of these industries are way be- 
hind, many of them not even started in many of these countries. 

What we have done is we have taken our detailed information 
down at the next two or three levels beyond this, this research, and 
we have been following not only failures but the extreme details of 
this status, and we have put together now an analysis, analytical 
analysis, associated with our predictions related to the infrastruc- 
tures within these countries and what some of the likely outcomes 
will be. Now if we take those four categories of the countries down 
at this lower, bottom slide on the floor here, you can see they have 
been categorized across the top of this slide, and as you can see. 
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in category 1, which the United States would be in, we have identi- 
fied a situation such that we will have isolated and minor problems 
related to power loss. We do not see at this point in time serious 
or severe power loss especially across or broad-based across the 
United States. We see that we will have some problems. There will 
be some interruptions, especially down within community power 
companies, very small facilities and so forth, and we have cat- 
egorized those as isolated and minor. 

Same thing with telephone operations. Isolated and minor issues. 
As you can see, if were to go across to the last category of countries 
that are in the most severe condition, when we talk about power 
loss, they will experience a widespread and moderate. And these 
categories down at the bottom — ^by the way, when I say wide- 
spread, I am talking about the distribution of the failure and the 
problem throughout the entire country — and then the second item 
is associated with the severity. So we are talking about widespread 
and moderate situations as far as power loss, as far as telephone 
operations and interruptions. 

And when we get to government services within those countries, 
we are talking about a situation where we have widespread dis- 
tribution and extremely severe severity issues. The governments in 
many of these countries have not started any activity whatsoever 
in some cases. If they have started, they are way behind. 

Next slide, please. So if we look at failures that are likely in each 
of these cases associated with these countries, associated with 
these industries, if we look at failures overall, what we find in our 
research also — and also by following the history of these failures so 
far — ^we find that a failure, any mission critical failure will cost 
anywhere from in a smaller company as little as $20,000, which 
could be extreme to some small Wsinesses, up to $3.5 million to 
get themselves back operating associated with a mission critical 
failure. This is the range of what it will cost by failure. 

Also, a key point here is that failures overall, when we talk 
about all these failures that will occur, 10 percent of them we are 
predicting will last 3 days or longer. It is likely that a small per- 
centage will last more than 3 days, but we know that, and we can 
predict that 10 percent will last 3 days or longer. 

Chairman Bennett. Is that in the United States? 

Mr. Marcoccio. That is overall, worldwide across all industries 
all countries. In the United States, we have also calculated and 
find that, yes, that holds true in the United States as well. 

Next slide. Now another point I would like to bring up is one of 
the things that I hear all the time in working with many compa- 
nies, in fact doing conferences and talking with clients throughout 
the world and many country governments, there is still a misnomer 
out there. You were talking about awareness earlier, Mr. Chair- 
man. The misnomer is that many people think that Year 2000 fail- 
ures will occur at the strike of midnight January 1, 2000, and that 
that is our only fear and our only threat. That is absolutely not the 
case. In fact, we are talking about at the actual millennium roll- 
over, the failures that are likely to occur are related to the embed- 
ded chip failures that are likely to occur or happen. 

We do find in our research, by the way, that the number of em- 
bedded chips, and we have been working with many engineering 
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organizations, manufacturers of chips, and manufacturers of many 
types of equipment, we do find that a small percentage of embed- 
ded chips, a very small percentage, will fail in total. I have seen 
numbers publicized about 30 billion chips that we have, embedded 
chips throughout the world, and I have seen numbers of 10 or 20 
percent that are likely to fail. Our research does not show those 
numbers. In fact, our research shows that embedded micro-control- 
lers, we are talking about 1 in 100,000 as far as failing. 

Now, unfortunately, that 1 in 100,000 may be running a very 
critical operation as far as power operation or life support system 
or whatever. So, of course, they have to be researched and evalu- 
ated and analyzed. But the number of actual failures we are going 
to see from embedded systems or embedded chips will be very 
small in number. But the embedded chips that do fail, however, 
most of them will fail at the strike of midnight, January 1, 2000. 
That is the way they are engineered, designed. In fact, they are en- 
gineered to monitor 8 second intervals, and within 8 seconds of 
that strike at midnight, those embedded chips will fail. The major- 
ity will fail. 

However, when we look at computer systems throughout the 
world that are likely to have failures, those failures, of course, have 
been occurring already in low volumes for some time, through the 
1970’s, 1980’s and so forth, and, in fact, throughout 1997 and 1998, 
we have had quite a few failures. The volume has gone up some- 
what in regard to material resource planning systems, in regard to 
many devices or systems that are used to forecast information, 
quarterly or yearly forecasts, especially 2 or 3 year forecast infor- 
mation. 

So in 1998, we have been seeing failures occurring. In 1999, we 
are expecting that the volume will go up considerably. Most compa- 
nies are going to be entering their fiscal 2000 as far as their busi- 
ness fiscal years, and we also have many other attributes that will 
cause the volume to go up considerably in 1999. We will see fail- 
ures go up dramatically in the Year 2000, but they are not going 
to just peak and drop quickly when we hit 2000. These failures will 
occur at a fairly consistent rate throughout the entire year of 2000. 
We have many transactions in many of these systems that do not 
occur at the strike of midnight. They occur either the next quarter 
or within the next segments of business throughout the entire year. 
And this will continue in 2001 at a reduced rate, 2002, so we are 
talking about a 3 to 4 year period of considerable number of likely 
failures. 

Chairman Bennett. I have to interrupt you here. I need to get 
over to the vote and we will return as quickly as we can. This is 
fascinating stuff and I have some questions for you, but I apologize. 
The committee will stand in recess. 

[Recess.] 

Chairman Bennett. The committee will come to order. OK. Mr. 
Marcoccio, again my apologies for the interruption. We are back to 
your last chart, as I understand it. 

Mr. Marcoccio. OK. Great. Well, my point on that last chart 
was, of course, that the failures will occur over a 3 or 4 year period 
as opposed to a single point in time and when we look at risks and 
we talk about potential effects, global effects, economic effects and 
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so forth, we really need to be thinking about that entire spectrum 
or period of time as opposed to one point in time. 

And my last comment that I wanted to make basically is associ- 
ated with the potential risks to the United States specifically. From 
a domestic perspective, the risks that we have identified or high- 
lighted as being most important are the interruptions or failures 
due to interdependencies and interconnections between companies 
and countries and we feel that can produce a considerable negative 
impact. Second, of course, the IT systems in critical industries that 
will not be fixed in time because many of these companies just will 
not have time because of the 30 month factor and the amount of 
time it takes to get mission critical systems completed. And then 
there are several other risks, of course, that I have in my testi- 
mony, but from a foreign perspective, the foreign business interrup- 
tions which would impact, too, many U.S. companies, of course, 
from a dependency perspective — foreign security issues ignited by 
things like unrest or severe economic issues. Many of these coun- 
tries, of course, that I had in that fourth category, we are talking 
about the likelihood for significant impact to their basic infrastruc- 
ture. 

So things like foreign security, national security, as well as un- 
rest in those countries, is very likely in our estimation. Key foreign 
government agencies will experience significant failures and there- 
fore the interrelationships between our government agencies, mili- 
taries and so forth are also highly critical. 

And this last point is associated with our recommendations to 
the committee. I guess the most primary recommendation would be 
to identify either a specific Federal agency or group that exists 
today to manage and coordinate the global impact of Year 2000. We 
think this is of ultimate importance. Of course, all the other issues 
and items that are being dealt with within the committee we feel 
are important as well, but we feel it needs a major focus as far as 
addressing the global impact issue. 

And the second recommendation is associated with the Security 
and Exchange Commission, and I know, Mr. Chairman, I think you 
have done some great work in trying to drive the issue of disclosure 
throughout the United States as far as publicly held companies. We 
find in our research, however, that there is a vast amount of dif- 
ference between what has actually been disclosed thus far and the 
actual status within the majority of companies, even here in the 
United States. 

We do find that a lot more as far as numbers of companies do 
intend to at least make or fill or provide their disclosure state- 
ments in this next quarter, related to some contingency work and 
so forth, but we still find, even with the work that is being done 
today, a considerable difference in reality versus this extreme opti- 
mism. We would strongly recommend that a policy be adopted 
where either the SEC or another independent agency or company 
actually provide a set of random audits associated with these com- 
panies. As we all know, this process works at least relatively well 
as far as our IRS and our tax returns, and we feel that that is defi- 
nitely necessary in order to get these disclosures much more accu- 
rately implemented. 
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And last, the recommendation I would like to bring out is associ- 
ated with new legislation that is implemented. We would like to 
see all new legislation questioned as far as determining if it may 
require IT modifications and systems. There is an awful lot of legis- 
lation that is launched that requires in many of these industries 
we are talking about being far behind — education, health care and 
many others — to go and make changes in their systems related to 
reports, related to regulations and other types of changes. We 
would like to see an evaluation be made or at least some kind of 
quick assessment be made on any of these pending legislations and 
that we would ask that these types of things as much as possible 
be put off or stopped because we are basically adding to the serious 
condition — the fact that they have to go out and spend critical time 
implementing those changes. 

Last, we would like to also recommend that we set correct expec- 
tations within the U.S. Government agencies and also any other 
awareness activities that comes out of the committee associated 
with the period of time that these failures will take place. We find 
even in reports and documents from our U.S. Federal agencies that 
there is a misnomer associated with the period of time that these 
failures are likely to take place. So we would hope that some effort 
be put in place to accurately make aware individuals and within 
our Federal agencies that we are talking about a much longer pe- 
riod of time for potential failure and risk. 

[The prepared statement of Mr. Marcoccio can be found in the 
appendix.] 

Chairman Bennett. Thank you very much. I have a whole series 
of questions I would like to sit down and discuss with you and we 
could take all of the rest of the morning with you. Unfortunately, 
we do not have that time. And the Senate vote has eaten up half 
an hour or more of our time in addition. Let me ask you if you 
would be willing to respond to questions in writing that would be 
made part of the record? 

Let me just pick out several of the things you have said in your 
testimony. You talked about 1 to 3 days being the duration of some 
of these problems. Thus, I think the implication in some people’s 
minds is, OK, the problem will hit and we will have 3 days to solve 
it and then it will be over with. And that brings to mind the state- 
ment by one nuclear physicist in Russia who said we plan to do 
nothing about Y2K. We will just let it come. When it hits, we will 
see where the problems are, and then we will buy the fixes from 
the United States. So that is the easy way to deal with this. 

I want to give you the opportunity to correct the impression that 
no matter how bad it is, it can be fixed within 3 days. 

Mr. Marcoccio. OK. Well, we do do a pretty thorough analytical 
analysis associated with that information, but one point I would 
make in regard to that would be that since we are talking about 
many millions of failures that will take place and even mission crit- 
ical failures throughout the world, when we talk about all failures 
in the millions, 10 percent of those will last 3 days or longer. That 
is extremely substantial in our mind to have 10 percent of a very, 
very large number last 3 days or longer. We are talking about busi- 
ness interruptions where a factory that runs three shifts a day may 
not be able to operate for 3 days or longer. We are talking about 
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situations where goods that may have a very short shelf life not be 
able to be delivered within 3 days. We are talking about very, very 
substantial unfortunately ramifications associated with that 10 
percent. 

So I by no means meant to lighten the situation with the 10 per- 
cent, but when we look at the real numbers, the likely number is 
in the millions throughout the world of total failures. Yes, 10 per- 
cent will last 3 days or longer is likely to occur and what we are 
predicting. We feel that is a very, very large number. We also feel 
a percentage of that will last 15 days or longer as well. In many 
cases, if you are talking about extreme conditions, if you are talk- 
ing about basic infrastructure, very large corporations, to have a 
failure and a business interruption and a large portion of a busi- 
ness actually shut down that operation for 15 days or longer we 
feel is a very, very serious and severe situation. So, yes, I did not 
mean to make that sound like a very light statement. We feel that 
is pretty severe. 

Chairman Bennett. Yes. No, I know you did not. And that is 
why I gave you the opportunity. I come back to this chart that says 
4 years. We have to look at the macro world in terms of the lasting 
impact of this thing dragging out over that period of time. 

Now, back to your chart on the level of readiness in various coun- 
tries. I have the feeling that some countries will simply drop off the 
radar screen and may be there. That is out of sight in terms of 
their ability to connect with the world for several years. Is that a 
correct? 

Mr. Marcoccio. I think that extreme situation is possible in 
some cases, yes. 

Chairman Bennett. And if that is a country where we are — we, 
the Western world, not necessarily just we the United States — tak- 
ing critical materials, the interruption of that supply chain will 
cause enormous repercussions. The Western world will not stand 
for an interruption for several years and will find alternative 
sources of supply. Therefore, the country that is just beginning to 
build itself up economically on the basis of whatever it is they 
produce suddenly finds themselves wiped out of its ability to com- 
pete. The desire of industrialized nations to have alternative supply 
sources turns them to their competitors. Even if they then get their 
Y2K problem solved, they are so far behind the market they cannot 
ever climb back into a competitive position. As a result we will 
have a serious humanitarian problem; CNN will go in with their 
cameras and show starving children. Last time CNN showed starv- 
ing children in Somalia we sent in troops, and I think we are going 
to have other aspects of that in various countries around the world 
as a result of this problem. 

Now am I overstating it? Do not hesitate to disagree with me. I 
am not trying to make a political point here. I am trying to get in- 
formation. If I am overstating it, tell me and tell me why. 

Mr. Marcoccio. No, I think that situation is definitely possible 
in some number of countries. Some of these companies basically 
that are in that fourth category have situations where they have 
dependency within their government agencies. Many of the coun- 
tries in that category, basically the country owns the power com- 
pany, the telecom company. In some cases, we are talking about 
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food distribution being heavily owned or supported by the govern- 
ment. We are talking about situations where we already have close 
to or at starving situation of people and food. We are talking about 
countries where we already have some unrest occurring. 

Considerably, in many of those countries, we are talking about 
situations where they have threats between their country and oth- 
ers from a national security perspective. So we already have a pret- 
ty significant situation, even from a global economy perspective as 
well with those countries, and this is going to add considerable tur- 
moil to those countries and in some cases may do exactly what they 
said and actually may shut them out of any type of global market 
opportunities. 

Chairman Bennett. OK. Thank you very much. I have many 
more questions I would love to discuss with you. 

Mr. Marcoccio. We would be glad to submit answers in writing 
or follow-on meetings or whatever. 

Chairman Bennett. All right. We will do that, but in the inter- 
est of time I will turn to Senator Smith. 

Senator Smith. In the interest of time, I will just submit written 
questions. 

Chairman Bennett. OK. Thank you again, and our apologies for 
the interruptions. It has been very useful. 

We would like now to hear from the Honorable Fred Hochberg, 
Deputy Administrator of the SBA. We had planned to have him on 
a panel with a number of other witnesses. Mr. Hochberg, given 
your time pressures, I think we will hear from you first and ask 
you your questions and then hear from the other members of the 
panel. Again, we apologize to you. I think you probably would learn 
from the questions and answers from the other members of the 
panel. So we invite you to stay as long as you can, but we do un- 
derstand the pressures that are on you and we will hear from you 
now. 


STATEMENT OF HON. FRED P. HOCHBERG, DEPUTY 
ADMINISTRATOR, SMALL BUSINESS ADMINISTRATION 

Mr. Hochberg. Thank you. Thank you, Mr. Chairman, for invit- 
ing the U.S. Small Business Administration to testify before your 
committee. My name is Fred P. Hochberg, Deputy Administrator of 
the SBA. I appreciate the opportunity to discuss the Year 2000 or 
Y2K problem facing the nation’s 23.6 million small businesses. Be- 
fore I begin, I would like to applaud both you, Mr. Chairman and 
Vice Chairman Dodd, for your leadership on this issue. I would ask 
that my full statement be made part of the record. 

Chairman Bennett. Without objection. 

Mr. Hochberg. As someone who has run a small business and 
met a payroll, let me assure you I know firsthand how potentially 
disruptive the Y2K bug may be to a business. We at the SBA are 
committed to doing all we can to minimize the impact of the Y2K 
problem on America’s small businesses. To some extent all small 
businesses may be affected since any firms with non-Y2K compli- 
ant hardware, software or equipment with time-dependent chips 
are potentially at risk. 

And small firms should not forget their dependence on outside 
entities. A business that has addressed its Y2K issues in-house 
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could still suffer or fail because a key outside firm with its own 
Y2K problem fails to perform. However, it is clear that with fore- 
sight and preparation, the problem can be avoided or at very least 
minimized. 

In July of this year President Clinton issued a challenge to both 
the private and public sectors to work together to address this criti- 
cal issue. The President’s Council on the Year 2000 Conversion 
under the dynamic leadership of John Koskinen has spearheaded 
the administration’s efforts in dealing with this problem. Let me 
briefly update you about what the SBA is doing to ensure that our 
own computer systems are Y2K compliant and what SBA is doing 
to help our customers. 

With regard to SBA’s internal computer systems, I am pleased 
to inform you that as of today we have completed the renovation 
of the computer programs in all of SBA’s mission critical systems 
ahead of the targeted goals for the Federal Government. 

Let me now turn to discussing how SBA is striving to help the 
nation’s small businesses cope with the Y2K issue. Our goal from 
the beginning has been to bring the seriousness of this problem to 
the attention of the small business owners without creating undue 
panic. As a result of our work with industry experts, we have de- 
veloped a common sense three-step program that anchors our Y2K 
outreach efforts. 

First, businesses are encouraged to conduct a self-assessment to 
see if they may have defective computer hardware and software as 
well as any equipment using date sensitive embedded computer 
chips. 

Second, businesses are encouraged to take action immediately. 
Now is the time to begin evaluating and addressing one’s vulner- 
ability to the Year 2000. 

Third, businesses are encouraged to stay informed about this 
issue. Accurate Y2K compliance information could change and busi- 
ness owners need to keep abreast of any modifications they may 
need to make as a result of changes in their business operations. 

Part of this process also includes following up to ensure your 
suppliers and distributors are Y2K compliant and developing con- 
tingency plans to deal with problems that may arise or are beyond 
their control. These three steps form the basic message of our pub- 
lic awareness program. We have prepared a series of materials and 
services to notify small businesses about the Y2K issue. They in- 
clude the posters you see in the room, fliers that we are putting 
in bill statement staffers such as this one, a toll-free hotline, a spe- 
cial Y2K section of our website, the address of which is 
www.sba.gov. In fact, since its inception in February of 1998, this 
site has been hit or visited over 840,000 times. 

Our traditional resource partners have been a tremendous asset 
in helping us spread the word about Y2K. Since our Y2K kickoff 
in early June with you Chairman Bennett and Vice Chairman 
Dodd, the SBA has conducted Y2K training events throughout the 
country. Since June, we have distributed more than two million of 
these fliers through our private sector partners such as financial 
institutions, utility companies and newspapers. 
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We are also very excited that recently we reached an agreement 
with the Internal Revenue Service to distribute nationwide 6.5 mil- 
lion of these fliers to small business owners. 

Before I conclude my testimony, let me tell you about an exciting 
activity we have planned for later this month. We will sponsor a 
nationwide Y2K action week during the week of October 19 to focus 
government, business and media attention on the Y2K problem. We 
have nearly 340 events already scheduled across the country in 
conjunction with this effort. I am also happy to report that 47 of 
those events are in States that members of this committee rep- 
resent. It is our hope that we can reach millions of small busi- 
nesses and motivate them to take action now on this critical issue. 

Let me conclude by saying the bottom line is small businesses 
need to take action now and stay informed on this issue. It is too 
late to start early. The reaction to our efforts has been overwhelm- 
ingly positive. As you return to your respective States in the com- 
ing weeks, we urge you to carry forward the Year 2000 message. 
You are uniquely situated to bring the urgency of this message 
home to the small business community. We frankly need your help 
in this effort and would be happy to provide materials or help you 
communicate with your small business constituents. 

For most businesses, the Y2K issue can be managed if they take 
action now while there is still time. Thank you, Mr. Chairman, for 
inviting the SBA to testify. I look forward to working with you and 
would be happy to answer any questions. 

[The prepared statement of Mr. Hochberg can be found in the ap- 
pendix.] 

Chairman Bennett. Thank you very much. We applaud what 
you have been doing. I note that John Koskinen has helped you in 
changing the title of Y2K Awareness Week to Y2K Action Week be- 
cause if we are only dealing with awareness we are too late. 

Mr. Hochberg. Exactly. 

Chairman Bennett. You are aware, I am sure, of the study that 
was done by the NFIB in conjunction with Wells Fargo Bank, in 
June or July where 82 percent of small businesses said they had 
no Y2K plans and, more chilling for me, 40 percent or roughly half 
that number said they did not plan to get any Y2K plans. Now you 
have done yeoman work in trying to get the word out. Do you have 
any statistics that could be used to counter those summer numbers 
to say that the percentage of small businesses that are now going 
to try to deal with this might be going up or do we just have the 
number of hits on your web site and a general feel that things are 
better? 

Mr. Hochberg. We have not conducted research in terms on the 
extent of the problem. I believe NFIB has done so and has some 
updated information on that. 

Chairman Bennett. Good. We will hear from them next. 

Mr. Hochberg. But we are mounting this campaign and organiz- 
ing many events the week of the 19th to make sure we do get this 
message out. I was a small businessman. I ran a catalog company, 
and I understand you deal with the upcoming season, how to get 
inventory in, and deal with payroll issues. It is harder to get a 
small business person to focus on something that seems like an 
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eternity, 15 months away. We have mounted this effort because we 
know there is that potential problem. 

Chairman Bennett. I understand exactly having run several 
small businesses myself. May I inject a somewhat cautionary note? 
I am delighted that you are reporting that your mission critical 
systems are remediated and you are going to be in good shape. 
Here in the Senate, we have gone through the process of trying to 
make sure that the Senate computers are compliant, it would be 
very embarrassing for me if I am out here sounding the cry for all 
the rest of the world and my own computers do not work. I have 
found that the first reports of getting things under control are al- 
most always more optimistic than the fact. And I would really be 
very stunned, very pleased obviously, if all the PC’s on everybody’s 
desk at the SBA were ready. I have a suspicion that maybe that 
is not the case. 

So I would just suggest to you as the top manager, now that you 
have gotten your optimistic report, go back and start asking some 
troublesome questions, and I think you will discover that some peo- 
ple said, oh, well, we did not mean that. And just as I want to 
avoid the embarrassment of having the Senate not be Y2K compli- 
ant all the way through, you want to avoid the embarrassment of 
having the SBA not be compliant. There are certain of our col- 
leagues that I would just as soon not alert. [Laughter.] 

But we will let that one go by. Senator Smith. 

Senator Smith. Mr. Hochberg, thank you for your testimony. I 
understand the SBA will be guaranteeing 50 percent of the loan 
value up to $50,000 to help small businesses pay for Y2K fixes. 
Can you characterize or project how quickly the guaranteed fund- 
ing will enable small businesses to complete remediation and test- 
ing efforts? Do you have a sense of timing on that? 

Mr. Hochberg. Senator Smith, all of SBA’s loan programs cur- 
rently are available for Y2K remediation — from our LowDoc and 
SBAExpress programs that were just expanded last month and 
through our regular 7(a) and 504 loan programs, which are for 
larger amounts, up to $750,000-$! million respectively. They are 
all available to be used for these efforts. And our newly expanded 
programs, the LowDoc, standing for low documentation, and 
SBAExpress allow 36 hour approval times. They are very quickly 
available so that should not be an impediment to a company get- 
ting the funds, and those loans can be paid out 5, 10, or 15 years 
to amortize the cost of those changes. 

Senator Smith. Are you getting many people seeking loans for 
this specific reason? 

Mr. Hochberg. Our loan programs are loan guarantees. So, in 
fact, we often do not see the precise nature of some of those loans. 
But our banks are alerted to that. In every forum that our district 
officers speak in, we make sure people are fully aware that these 
programs are available. 

Senator Smith. Do you notice banks pushing small businesses to 
make sure their customers are Y2K compliant? 

Mr. Hochberg. The banks have been some of our best partners. 
The American Banking Association, in fact, took our entire training 
and education program and incorporated it into their documents. 
Nations bank and Wells Eargo are actually distributing this to 
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their customers and working with other banks to do so as well. So 
the banks have been, as the gentleman from the Gartner Group in- 
dicated, at the forefront and I believe small businesses do listen to 
their bankers. 

Senator Smith. Thank you very much. I guess bottom line there 
is really no reason people should not be doing this in small busi- 
ness. They just solve the problems if they are aware of it. I do not 
imagine that for most large companies the Y2K problem would be 
a large financial hit, but it potentially could be if they do nothing 
about it. So thank you for your efforts. 

Mr. Hochberg. Certainly. 

Chairman Bennett. Thank you. And you are more than welcome 
to stay or if you have to leave, we will understand. 

Mr. Hochberg. Thank you. 

Chairman Bennett. We will now have the other members of the 
panel on small business join us: William Dennis, senior research 
fellow at the National Federation of Independent Business; Mr. 
Rod Rodrigue, director. Manufacturers Extension Partnership from 
the State of Maine; and Mr. Harold Schild, president/CEO of 
Tillamook Cheese. And I have eaten Tillamook Cheese so I can en- 
dorse the comments of the Senator from Oregon with the caveat 
that Cash Valley cheese in Utah is of equal quality. 

All right. Mr. Dennis. 

STATEMENT OF WILLIAM J. DENNIS, JR., SENIOR RESEARCH 

FELLOW, NATIONAL FEDERATION OF INDEPENDENT BUSI- 
NESS 

Mr. Dennis. Being originally from Wisconsin, I am going to have 
to argue with that. But thank you very much, Mr. Chairman. The 
bulk of my testimony today will be a report that was produced. 

Chairman Bennett. Yes, and it will be without objection in- 
cluded in the record. 

Mr. Dennis. Data for the report were collected in April, late 
April. We will update that report later this month. In fact, I had 
a conversation yesterday with the Gallup organization so we are 
about ready to go in and essentially repeat what we did earlier. My 
judgment is that the October-November data will be much more op- 
timistic or encouraging than was the spring’s. However, I say that 
from experience rather than data. Many small business owners, as 
you are well aware, have immediate pressing problems and those 
tend to go right to the top of the list. So the current status is not 
totally unexpected although not always totally understandable ei- 
ther. 

Chairman Bennett. Can you pull the microphone a little closer 
to you? 

Mr. Dennis. Surely. Is this better? 

Chairman Bennett. Thank you. Yes. 

Mr. Dennis. The critical finding in the spring report was that 
over 80 percent of the small businesses in this country are poten- 
tially exposed directly to a Y2K problem. To take it a little bit fur- 
ther, think of dividing the small business population into fifths. A 
fifth of them does not understand that there is a Y2K problem. 
They are not aware of it. A fifth are currently taking action. A fifth 
have not taken action, but plan to take action. Two-fifths are aware 
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of the problem and do not plan to take any action prior to the Year 

2000. 

If we put together the people who do not have computers or em- 
bedded chips as well as those who have taken action and feel com- 
fortable, we have approximately 40 percent of the small employer 
population. At the other extreme are those which plan to take no 
action, and who are computer dependent to the extent that if they 
lost their computers or the computers malfunctioned, would lose 85 
percent or more of their production or sales. That effectively means 
they would have to close down for a period until they can fix it. 
About 330,000 businesses fall into that category. If you cut the 
amount of computer dependence somewhat, then you about double 
the number. So we have a serious problem among a significant 
number of businesses. 

Aside from the general liability issues that you have talked about 
on other occasions and an assumption that the credit markets do 
not go south on us, it seems to me that the primary function or role 
of the Federal Government other than taking care of its own house 
is to serve as the village nag. It would be helpful quite frankly, and 
many of you are doing so, to 

Chairman Bennett. I have been called a lot of things, but — 
[Laughter.] 

Go ahead. 

Mr. Dennis. One of the critical points is to nag the right people. 
Let me refer you to a study conducted by the Small Business Ad- 
ministration in 1994 titled “How Small Businesses Learn.” That 
study focuses on how government can communicate with the small 
business population. There are two key groups. The first key group 
are trade associations, but specifically industry-specific trade asso- 
ciations. The reason that they are critical is not only because they 
have good contact with small business owners, but because they 
also are aware of the equipment that is used within those indus- 
tries. It is the kind of information that someone interested in 
smaller firms or knowledgeable about smaller firms in general 
would not necessarily have. So industry-specific trade groups are 
very important because of what they know and because they have 
enormous credibility within the population itself. 

The second group that has enormous credibility within the popu- 
lation itself are colleagues and business associates. You spoke ear- 
lier about banks and their relationships and indeed they have been 
out in front from what we have seen. But there are other types of 
organizations as well, large and small, which would do well to im- 
press upon their customers and suppliers the need to be Y2K com- 
pliant. 

The upshot is that government would do well to focus on its 
bloody pulpit function and this it can do quite well. Thank you very 
much, Mr. Chairman. 

[The prepared statement of Mr. Dennis can be found in the ap- 
pendix.] 

Chairman Bennett. Thank you. Mr. Rodrigue. 
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STATEMENT OF ROD RODRIGUE, DIRECTOR, MANUFACTUR- 
ERS EXTENSION PARTNERSHIP, STATE OF MAINE 

Mr. Rodrigue. Thank you. Senator Bennett, Mr. Chairman, and 
Senator Smith, I am here today from the great State of Maine to 
hopefully bring across more solutions than problems. I am presi- 
dent of the Maine Manufacturing Extension Partnership, which is 
part of a national Manufacturing Extension Partnership, put to- 
gether by NIST under the Department of Commerce. Our primary 
mission is to help small and medium-size manufacturers become 
more globally competitive by using the best available technologies. 

We are the folks in the trenches that talk to these manufacturers 
and try to find out what we can do to help them. What we have 
done in Maine and the reason we have been asked to come here 
today is to tell you a little bit about what we have done as a model 
program. When we saw all the great number of manufacturers that 
could potentially be affected by Y2K, we got very nervous about 
what would be happening to our manufacturing base in Maine. 
With 2,500 manufacturers in Maine, 88 percent of them hiring 
below 100 folks, we started to look at these manufactures as the 
ones that were the most at risk. 

A few months back NIST came out with a Y2K assessment tool. 
This tool is a mechanism you can hand to manufacturers enabling 
them to actually do an assessment of all of their inventories. It 
looks at the supply chain, and allows them to look at their embed- 
ded systems. Eor just 1 second, if you could, just visualize a manu- 
facturing facility with 50 or 60 machines from a dozen different 
countries all with embedded chips networked together out of cus- 
tomized software, not knowing who put in the custom systems in 
some cases. It becomes very complicated. We have seen so much 
apathy with small manufacturers that we decided to call every 
manufacturer in the State of Maine. We estimate 500 to 600 will 
need help. 

We took this Y2K tool and linked up with SBDC’s, SBA folks, 
business visitation folks and so forth, and will deliver this tool to 
every single manufacturer that needs it on a personalized basis. 
We have heard today about the apathy and it really is there, but 
once a manufacturer uses this tool and complete their system in- 
ventory, lights come on and the manufacturers understand the 
value in going through an assessment. 

The real back breaker in this whole process is proceeding from 
the awareness to the remediation phase. They cannot get their 
arms around the remediation problem. This process gives them a 
road map. At the end of this engineering road map, the mission 
criticals are identified and prioritized. We attach a SBA LowDoc 
loan application instruction sheet that gives them not only the 
means, but a mechanism. Then we take and help them through 
their remediation process. 

The real good news is that this document, this tool, sits in the 
hands of about 2,500 MEP folks all around the country. There are 
400 offices in all 50 States and Puerto Rico. They are affiliated 
with 3,500 other agencies that can help distribute the tool. What 
we are doing in the State of Maine we think would be a good 
model. We will continue to talk about Y2k awareness and put the 
action together. We have handled about 50 companies so far. 
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In your letter you asked me what it is the Government could do 
to assist in the situation. In Maine we have begged and borrowed 
and tried to put this product out on limited resources. With the 
lack of funding we will probably stop at about 100 or 120 compa- 
nies. MEP has yet 400 other companies to assess. The national 
NIST program, the MEP program has submitted a request for 
funding through the Department of Commerce. I am asking that 
Maine’s Y2K model program and the budget request be used to put 
this tool in the hands of all of the States in the union, allowing im- 
mediate delivery of this tool. Remembering that this is an assess- 
ment tool, we need to be mindful that manufacturers are looking 
at a narrow window of opportunity to complete and start the reme- 
diation process to be Y2K compliant. 

What we are asking today, I guess, or what I am asking today 
is to have this committee reach out and plug in this system and 
let us go out and actually start to do the work. I did not want to 
bore you with more statistics of how bad it is going to be. I want 
to say that we can go out now and start to cure this problem. The 
tools are there. The people are there. I am reminded of my first job 
where my first boss said do not bring any more problems, just 
bring solutions. I am hoping that is what I am doing here today, 
bringing you some solutions that make some credible sense. 

The national MEP system over the last 6 years has really been 
at the forefront of giving technology to the small and medium-size 
manufacturers in battling this global competition. We are in place, 
we are ready to go. We have the tool to go out and implement it. 
The bottom line for me, is to ask you to expedite or help us get the 
resources, the financial resources, to go forward with this program. 

I want to point out that these resources we are asking for is not 
to pay for the remediation process. It is to help promote more 
awareness and alleviate the existing apathy. We are ready to go 
and I just hope that you will help me step on this millennium bug 
and finally get it out of our hair. I would be more than happy to 
answer any questions and I thank you for inviting me. 

[The prepared statement of Mr. Rodrigue can be found in the ap- 
pendix.] 

Chairman Bennett. Thank you. Mr. Schild. 

STATEMENT OF HAROLD SCHILD, PRESIDENT/CEO, 
TILLAMOOK CHEESE, INC. 

Mr. Schild. Schild. That is fine. Thank you. Chairman Bennett 
and Senator Smith, I want to thank you for providing me an oppor- 
tunity today to share our experience as a relatively small farmer- 
owned dairy cooperative in dealing with the Year 2000 computer 
problem. We were first made aware of the problem back in Feb- 
ruary of 1996 during a routine annual audit by one of the Big Five 
firms, and at that point, we authorized Management Information 
Services to research the validity of the potential for problems in 
our computer systems. They reported that, indeed, there was a real 
danger of complete calamity when January 1, 2000 rolled around 
and that we should begin immediately toward correcting the prob- 
lem. 

Now, Tillamook County Creamery Association is 150 member 
dairy cooperative. We are nestled between the Coast Range Moun- 
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tains and the Pacific Ocean, about 75 miles west of the Portland, 
OR metro area. The association has about 400 employees and we 
have sales of about $160 million per year. We are totally branded, 
value-added dairy products, primarily cheddar and premium ice 
cream. 

At the time we became aware of the Y2K problem, we had an 
MIS staff of two people. Despite our efforts, we have been unable 
to attract additional staff to our coastal area to cope with everyday 
programming demands plus deal with the Y2K bug in addition to 
their daily responsibilities. Many other companies in the metro 
area that are able to pay higher salaries have engaged most of the 
qualified programmers in the region. 

Our approach was to form teams that would think of all the po- 
tential problems in their areas. Some of our people were sent to 
seminars to gain better understanding in where to search for the 
Y2K bugs. A few of the potential problem areas they found, of 
course, were our accounting software, electronic data transfer be- 
tween our order desk and our customers, member and employee 
payroll, quite an important area, point of sale programs. We have 
a visitors center that hosts about 900,000 visitors each year, and 
that, of course, was a real critical area for us as well as our farm 
store and dealing with our members. 

A question about our suppliers — were they going to be compliant 
and able to continue to supply a regular flow of product to us? 
Were there legal issues? Questions we did not have answers for. 
Were we in jeopardy of defaulting on some of our contracts and 
agreements. Financial transactions. Were customers’ payments 
going to come through in a timely manner? Was our order recep- 
tion and processing going to be up to date? Were we going to be 
able to accept customer orders on a timely manner and get the 
product to them as expected? 

And, of course, our automated product processing. We have a 
fairly modern cheese plant and processing, and we are concerned 
with the program controllers that actually operate that system. To 
date, our accounting department estimates that our out-of-pocket 
cash expenditures will exceed a million dollars to avoid a major 
Y2K problem. This does not include any of the internal costs of 
staff time or expense for training. The loss of productivity inter- 
nally because our people are busy with Y2K issues is also not in- 
cluded in this cost estimate. These costs will be directly borne by 
our dairy members, many of whom are struggling to make ends 
meet already. 

At the present time, we are applying a test program to all of our 
software to determine just where the bugs are hiding. We are con- 
fident that TCCA will be Y2K ready before the fall of 1999 if we 
do not experience delays in receiving software. We have contracted 
for the installation of this software by April 1, 1999. And we expect 
no problems, but then I am sure there will be some surprises. 
There always seem to be. 

Looking at the rest of the industry, many of the CEO’s of dairy 
companies that I talk to express a wide range of views on Y2K — 
from disbelief that it is more than a computer industry hype to 
stimulate business to a view that the electronic world as we know 
it today will cease to operate, leaving commerce stalled, utilities 
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shut down, and only hand operated equipment functioning. Some 
project no additional costs to complying with Y2K while others esti- 
mate their costs like ours will run into the millions. 

As in many other industries, the large, well financed seem to be 
better prepared than those who are less sophisticated and more 
personally operated. I would rate the dairy industry generally to be 
at level II in the previous testimony for overall preparedness. Items 
that I would suggest perhaps Congress could help us on is that 
many persons still are not aware of the real potential for disaster 
that exists. This committee is an excellent vehicle toward a broader 
awareness level nationwide, and I compliment you for your efforts 
on this behalf. 

Some suggestions that could possibly help — Congress could act 
on — would be to establish a centralized government sponsored web 
page for all companies to log on to and to certify that they are com- 
pletely compliant. Other companies then could access this page to 
verify if their suppliers and customers are prepared to function 
after January 1, 2000. This would reduce duplication of efforts. 

Also, immediate tax recovery of all program upgrade costs. I un- 
derstand that IRS has stated that a portion of any new software 
or hardware needed for Y2K compliance could be expensed in the 
current year. However, much of the software and hardware needed 
to operate the new upgrades will not be immediately deductible be- 
cause it is not used solely for Y2K but may incidentally improve 
other non-Y2K functions of the operating systems. This upgrade 
must be expensed over a long period of time under the current IRS 
guidelines. 

I would say at this point that we are probably doing about 5 
years worth of software and hardware upgrades, all within the fis- 
cal year 1999, in order to cover the Y2K bug. We normally would 
spread this over a longer period of time. 

Third, if Congress could assure those of us in industry that gov- 
ernment services will be fully compliant. I understand there is 
many Federal, State, and local public bodies such as utilities, emer- 
gency services, financial institutions, and transportation services 
that are not Y2K compliant and claim they do not have the re- 
sources to become compliant by January 2000. I thank you for this 
opportunity to express the Y2K status of our cooperative in Oregon 
and hopefully it will help others avoid a major crisis just 65 weeks 
from now. 

[The prepared statement of Mr. Schild can be found in the ap- 
pendix.] 

Chairman Bennett. Thank you very much. This has been useful 
to get this range of information. Unfortunately a pattern is being 
repeated here that we have seen in other hearings which is that 
the witnesses we get before us are the witnesses who know what 
they are doing. And they give a false impression that things are 
better than they really are because the witnesses that do not know 
what they are doing refuse to come forward. So the good ones are 
here and we recognize you as being representative of the good ones. 
The others raise great concern for us. 

Mr. Dennis, you have talked about trade associations and other 
colleagues and associates and you highlighted banks. Do you have 
the sense that banks, credit unions and so on, those gatekeepers 
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of credit, are starting to make this a loan issue? That they are be- 
ginning to say you cannot get a loan because we think you will not 
be able to pay it back because you are not going to be Y2K compli- 
ant? 

Mr. Dennis. Let me separate those two, Senator. 

Chairman Bennett. Yes. 

Mr. Dennis. In terms of obtaining loan money to become compli- 
ant, my sense is that is not an issue right now. 

Chairman Bennett. Yes. 

Mr. Dennis. We are in a situation now where credit is probably 
as easy to get for a small business owner as any time in the 23- 
24 years that I have been researching small firms. So I do not see 
that as an issue. The other portion of your question, are banks re- 
quiring Y2K compliance before they are issuing loans, I do not have 
a sense that that is a requirement at this juncture. I do have a 
sense that they are sending out letters to their — ^well, I do not have 
a sense — I know they are. A lot of banks are — are sending out let- 
ters to their loan customers which very specifically asks them 
about their Y2K activities and infers that it would be well if they 
took immediate action to remedy this problem. They are couching 
the inquiries in terms of having to do business back and forth over 
the wire, not necessarily with you, but with other people. There- 
fore, it should have all of its customers in compliance. 

Chairman Bennett. Mr. Rodrigue, your body language said you 
had an answer to that question. 

Mr. Rodrigue. Well, like I said, we are in the trenches. Senator, 
and they are starting to get very nervous. The bankers are sending 
letters inquiring about Y2K compliance. Credit terms and availabil- 
ity could potentially be affected. 

I should mention that by the use of the Y2K tool, gives them a 
due diligence document so they can show the banks that they have 
gone through an assessment. It is another big plus. This tool not 
only gives them a due diligence at the end of it, it allows them to 
move forward because it gives them a document that tells them 
how much resources they need to go through remediation. But the 
banking portion. Senator, is a very big concern, and I think that 
we are going to see a little more of a panic as the months roll by. 

Chairman Bennett. I am privy to the actions inside a major 
bank where the credit officers are saying we did not think this was 
a credit issue. We now decide that it is a credit issue, we think we 
are going to lose between 5 and 20 percent of our customers by our 
action. That is we will cut them off as bad credit risks on the basis 
that they do not have sufficient remediation in place. Therefore 
they are going to start holding credit and loan officers within the 
bank, accountable for the kinds of loans they make with respect to 
this issue. This is just one bank. However, I think it is a fairly sig- 
nificant signal to send to small business people when they go in for 
a loan in May or June 1999 and be told by the bank I know we 
have served you for 10 years, but we are not going to make this 
loan because we do not think you are going to be able to pay it 
back. 

And that raises an issue I will say here and probably repeat later 
on: One of the results of the Year 2000 problem is going to be a 
flight to quality. The banks will move to the quality loans, let other 
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people fall by the wayside. Suppliers will move or companies will 
move to quality suppliers; the ones that are more marginal, they 
are willing to take a chance on, will be in difficulty. And as I indi- 
cated with the testimony from the Gartner Group, whole countries 
will be affected because people will move to quality and they will 
go to reliable sources of supply. It can be for a small business an 
opportunity to become a source of quality and thereby step up over 
competitors who are not paying attention to this. It can be an op- 
portunity rather than a disaster. 

One quick question for you, Mr. Dennis. NFIB, as I understand 
it, does not have Y2K as a mandate yet. Are you planning to take 
a more aggressive stand on this in terms of leadership for your 
members on this issue? 

Mr. Dennis. It has been featured in our magazine, websites, 
links to other websites, and that sort of thing. I am not exactly 
sure what you mean by a mandate. I am a little bit confused by 
that. I am sorry. We clearly have done several things on the com- 
munication side and plan to do more, but 

Chairman Bennett. Yes. I am told NFIB members vote to put 
an issue on the top priority list or priority attention mandating 
what the staff will do and that has not yet happened. 

Mr. Dennis. Yes. No. 

Chairman Bennett. I am encouraging you to have that happen. 

Mr. Dennis. Thank you, yes. The liability issue has already been 
out. 

Chairman Bennett. OK. 

Mr. Dennis. And I would expect if that is on the voting side, 
yeah. 

Chairman Bennett. OK. Fine. Senator Smith. 

Senator Smith. Thank you, Mr. Chairman. Harold, we actually 
had considerable difficulty getting other food processors here and 
I wonder if you can conjecture with me why that might be. Is there 
a lack of awareness of it, not just the dairy industry but generally 
vertically and horizontally in the food processing industry? What 
do you think the awareness is? 

Mr. SCHILD. I think probably the food processing industry, espe- 
cially your smaller ones, are more manual and they do not recog- 
nize outside of their own daily operations the impact that it could 
have on them when it comes to customer suppliers. We feel that 
we are moving into becoming a little more sophisticated with our 
customers in electronic data transfer and so on, and I think our 
customers have probably been encouraging us. In fact, we are get- 
ting letters regularly now that demand that we acknowledge that 
we are compliant and or when we will be, and if that does not hap- 
pen, then they threaten to go to another supplier for their cheese. 

So I think maybe some in the agricultural arena are not perhaps 
as connected electronically with some of their customers and may 
not be feeling the pinch. I think in Oregon especially we have many 
commodity producers. I believe only about 15 percent of our agri- 
cultural sales in Oregon are actually to the end user. And therefore 
being more commodity driven, they are not likely to be dealing 
with the end users that are really demanding this level of compli- 
ance. 
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Senator Smith. Could a component of it be fear of being associ- 
ated with bad news? 

Mr. ScHiLD. Well, there is probably some of that. 

Senator Smith. Is legal liability part of it? 

Mr. ScHiLD. I guess that has not bothered us. 

Senator Smith. Well, actually I think there is a competitive ad- 
vantage to be marketed in some way to let your customers know 
you are Y2K compliant and you are on the bridge of the 21st cen- 
tury. 

Mr. ScHiLD. Well, we are certainly working that way and we are 
confident that we will be ready. But we still have questions. In 
fact, we are preparing the same compliance letters with many of 
our suppliers to make sure they will be able to serve us after Year 
2000. So it goes around. 

Senator Smith. I thank you for coming and for sharing with us 
and I hope that all of you will continue to do what you are doing. 
We appreciate it. Thank you, Mr. Chairman. 

Mr. SCHiLD. Thank you. 

Chairman Bennett. Thank you very much. We appreciate your 
being here. I will make this comment following up on Senator 
Smith’s comment. I have been in touch with some of the trade asso- 
ciations in the food industry and made it as courteously clear as 
I can that we will have representatives of the food industry testify- 
ing next year. We have the subpoena power on this committee. We 
have not had to use it up until now and I hope that the time never 
comes when we do, but one of the main concerns that the public 
has, particularly in some of the more alarmist websites with re- 
spect to Y2K, is whether or not there will be food on supermarket 
shelves. Many people are saying there will not be, and I have said 
to representatives of the food industry if you wish to allay this sus- 
picion and convince people that food will, in fact, be on the shelves 
in supermarkets on January 2 or 3 and it will be freshly delivered 
food, you had better come before the committee in making your 
case. Your unwillingness to come and share information with us 
only feeds the people who are pushing the panic button. 

So we will have representatives of the food industry before us at 
hearings next year. Another reason, Mr. Schild, why we are grate- 
ful for your coming. You are willing to go whether others never 
dared to go before. [Laughter.] 

We are glad to have you here. Thank you, all. 

Mr. Rodrigue. Thank you, Mr. Chairman. 

Chairman Bennett. We will go now to the final panel. This 
panel is flying two missions. They represent big business. We have 
had the representatives of small business. Now we are going to 
hear from the representatives of big business. And at the same 
time they are all concentrated in the pharmaceutical industry. So 
we will be able to get the kind of sense of availability and Y2K 
compliance in that key industry as well as get a sense of what 
large companies are doing. 

I think it is fitting that we started out with Ms. West who gave 
us the very graphic and moving description of how important this 
industry is, and now we finish up with the pharmaceutical indus- 
try. I am sure you all heard her testimony and we look forward to 
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learning how you intend to address the problems that she raised, 
at least from your part of this particular supply chain. 

We have with us Dr. Charles Popper, who is the chief informa- 
tion officer of Merck & Co.; Mr. Keith Mallonee, who is vice presi- 
dent of Information Technology at McKesson Corp.; Mr. Ronald J. 
Streck, who is the president and CEO of the National Druggists’ 
Association; and Mr. Richard Carbray, who is the general manager 
of a small pharmacy, Felton’s Pharmacy an Home Health Centers. 

Let me make one other comment. Senator Dodd was involved in 
a fender bender on his way in this morning and while there is 
nothing dramatic about it, he has got a sore neck. He is trying to 
get a little bit of relief and that is the only reason he is not here. 
Senator Dodd is usually the most faithful of all members and 
please do not misinterpret his absence as any kind of lack of inter- 
est. His written statement will be included in the record. 

[The prepared statement of Senator Dodd follows:] 

Chairman Bennett. So I see you have seated yourselves dif- 
ferently from the way I have it listed. Let us go in the order that 
you are seated. We will start with you. Dr. Popper, and then Mr. 
Streck, Mr. Mallonee, and Mr. Carbray. 

STATEMENT OF DR. CHARLES POPPER, CHIEF INFORMATION 
OFFICER, MERCK & CO. 

Dr. Popper. Thank you. Senator Bennett. Good morning, Mr. 
Chairman and members of the committee. My name is Charles 
Popper and I am Vice President of Corporate Computer Resources 
at Merck. In that position I serve as the chief information officer 
of Merck. Merck is a global, research-driven pharmaceutical com- 
pany that discovers, develops, manufacturers and markets a broad 
range of medicines. Thank you for inviting me to participate in to- 
day’s hearing. I applaud this committee’s efforts in both investigat- 
ing and publicizing the potential effect of the Y2K computer prob- 
lem. 

I would like to discuss what my company, Merck, is doing to deal 
with the problem. I would also like to provide a broader context 
that you may find useful. Our task at Merck has been to ensure 
that all computer programs that are in use anywhere within 
Merck’s worldwide operations will operate correctly throughout the 
transition into the next millennium, but our objective all along has 
been a more important one consistent with Merck’s company mis- 
sion. As George W. Merck stated many years ago, we try never to 
forget that medicine is for people, people just like Ms. West, I 
might add. 

Merck is solving its Y2K problem in order to ensure that we can 
continue to discover, develop, manufacture and distribute medi- 
cines that treat important human diseases. Our paramount goal is 
to ensure the continuity of the supply of medicines to our patients. 
At Merck we are doing so by following a simple strategy. 

First, we have inventoried all computer systems, applications 
and devices with embedded microprocessors. Second, we have as- 
sessed each of these systems to determine whether it includes any 
date processing and whether its correct operation is of serious con- 
cern to our business. As an example of a system where we are less 
concerned about a possible Y2K bug, consider a program that re- 
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ports monthly sales and organizes the columns of the report in 
chronological order. While we prefer to have the report continue to 
show the most recent results from right to left, if the Y2k were to 
merely cause the columns to print in a different order, this would 
only be a minor concern to us. We are deferring the repair of that 
kind of bug to the final stages of the Y2K project 

Third, we have developed a compliance strategy for each system. 
Fourth, we are executing that strategy for the many thousands of 
systems in our inventory. This is obviously a daunting task because 
of its magnitude and its geographic diversity. We have to deal with 
systems in the many hundreds of Merck locations worldwide. 

The fifth and final step is to thoroughly test all of our systems. 
Our attitude is to trust no one but ourselves. If a system vendor 
tells us that their application is Y2K compliant, we will insist on 
testing it ourselves or at least auditing in detail the test results 
provided by the vendor. We have already found instances of appli- 
cations certified compliant by the vendor that, in fact, did not pass 
our test initially. 

As you can imagine, Merck’s Y2K project is a very significant ef- 
fort. We began reasonably early in 1996. There are now in excess 
of several hundred people involved. We are spending many tens of 
millions of dollars to plan, execute, and manage this work. Our 
goal has been to achieve Y2K compliance by the end of this year, 
thus allowing all of a 1999 for dealing with the inevitable glitches 
and inconsistencies among systems. 

However, Mr. Chairman, fixing our internal systems is only part 
of the problem. Merck just as any global company works with many 
thousands of business partners, suppliers, customers, and govern- 
ment agencies. Our ability to continue our company’s operations 
successfully in January 2000 depends just as much as on the Y2K 
programs of these companies and agencies as on our own internal 
systems. Hence, we have organized two other major sets of activity. 

First, each business area is examining its business partners to 
assess its Y2K risk. If the proper operation of that entity’s systems 
is essential for Merck’s operations, we are both working with that 
entity to better understand its Y2K remediation plans and also de- 
veloping internal contingency plans just in case that entity that 
fails to achieve Y2K compliance on time. 

Second, we are working with the Vital Signs 2000 Project, which 
is a health system-wide effort organized by the Odin Group to gath- 
er important information about the Y2K compliance of the entire 
health care industry in which we participate. The Vital Signs 2000 
team has developed a survey instrument for the five groups of enti- 
ties comprising the health care industry: payers, providers, suppli- 
ers, distributors and government agencies. By understanding the 
cross-industry processes and their Y2K vulnerabilities, we together 
with the rest of the industry can develop the detailed contingency 
plans that can assure the continuity of high quality patient care. 

What about the broader American pharmaceutical industry? 
While I obviously cannot testify about the detailed plans and 
projects of Merck’s competitors, I have had the opportunity to dis- 
cuss the Y2K problem with my colleagues in other pharmaceutical 
companies. These companies have all followed a methodology simi- 
lar to Merck’s and are applying the level of resources needed to 
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deal with the problem. They have also recognized the broader 
issues of the readiness of business partners and are developing ap- 
propriate contingency plans. 

Let me close with some broader context. I read periodically that 
companies and agencies are now just waking up to the severity of 
the problem — we have heard about that this morning. Worse, I still 
read and hear about entities that still do not believe that there is 
a serious problem. They may be right in their local situation but 
only an organized testing program will allow them to be sure. So 
I do worry about what will happen as the clock strikes midnight 
on December 31, 1999. 

Again, I thank the committee for the opportunity to be here 
today and look forward to your questions. 

[The prepared statement of Dr. Popper can be found in the ap- 
pendix.] 

Chairman Bennett. Thank you very much. Mr. Streck. 

STATEMENT OF RONALD J. STRECK, PRESIDENT AND CEO, 
NATIONAL WHOLESALE DRUGGISTS’ ASSOCIATION 

Mr. Streck. Thank you. Chairman Bennett. The National 
Wholesale Druggists’ Association, or NWDA, appreciates the invita- 
tion to testify today before the committee about the applications of 
Y2K. And I ask my written statement be entered into the record. 

Chairman Bennett. Without objection. 

Mr. Streck. NWDA is the national trade association represent- 
ing distributors of pharmaceutical and related health care prod- 
ucts. Our active member companies operate 215 distribution cen- 
ters throughout the country that service every State, the District 
of Columbia, and U.S. territories. NWDA’s active members provide 
distribution services to over 130,000 pharmacy outlets in the coun- 
try including 21,000 independent pharmacies, 18,000 chain phar- 
macies, 7,500 hospital pharmacies, 220 mail order pharmacies, 
7,000 food stores, 5,000 mass merchandisers, 4,000 long-term care 
and home health care facilities, 56,000 clinics and 1,000 HMO’s. 

Our most recent data indicates NWDA member wholesale dis- 
tributors on average obtain products from over 750 manufacturer 
suppliers. Typically, a single wholesale distribution center stocks 
an average of 24,000 items and will process over 13,000 order lines 
per day. Virtually, all orders placed by pharmacy customers to 
their wholesale distributors are transmitted electronically and 
more and more electronic picking devices are used to fill these or- 
ders. 

To service an increasingly demanding and integrated health care 
market, practically all wholesalers provide daily deliveries with a 
growing number of wholesalers providing twice a day deliveries to 
their customers. However, today’s wholesalers do so much more 
than just deliver product in a timely manner. Some of the value 
added services NWDA members provide to their customers include 
marketing and advertising support, product sourcing programs and 
special handling services. 

Other services provided that are especially relevant to the Y2K 
discussion are the computer and information programs that include 
third party claims processing and receivable services, inventory 
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management, pharmacy computer systems for dispensing and care, 
and point of sale systems. 

Wholesalers have been innovators and leaders in information 
technology. They continue to use information technology to inte- 
grate suppliers and customers. These programs and systems rely 
on automation, connectivity, information systems, electronic link- 
ages, and network building that allow for the prompt and efficient 
delivery of lifesaving health care products. 

Our members have been methodologically working to ensure 
their systems and those of their customers are compliant. You will 
hear more about exactly what wholesalers have been doing from 
Keith Mallonee of the McKesson Corp. in just a few minutes. Based 
on a number of suppliers, customers and orders, it does not take 
long to speculate on what would happen if there were an interrup- 
tion of an electronic transfer of information. Many of these trans- 
missions are reliant on commercial and government telecommuni- 
cation networks, systems over which the pharmaceutical industry 
has no control. 

NWDA and its members need to know that these vital commu- 
nication networks are Y2K compliant and ready to support the de- 
livery of health care services to the patient. This constant elec- 
tronic transfer of information is the reason I am here today. As we 
have developed our association’s web page, NWDA has devoted a 
separate section just for dissemination of general Y2K information. 
We endorse the notion of common solutions for common process 
problems and we are ready to move ahead with an industry clear- 
inghouse for Y2K technical fixes that would allow drug wholesale 
trading partners to freely share such technical information. 

We have been reluctant to proceed with this project due to liabil- 
ity and antitrust concerns. However, with the passage of the Year 
2000 Information Readiness Disclosure Act, S. 2392, we under- 
stand that we will now be able to move ahead. We commend Con- 
gress for its approval of this important legislation and urge the 
president to move swiftly to sign the bill into law. 

We are greatly concerned that Federal, State, and local govern- 
ments are quickly running out of time to adequately test and cor- 
rect all public service and infrastructure systems. It is disturbing 
to read reports from Congress and the GAO indicating that there 
are serious concerns, that many Federal agencies will just not be 
ready. The July 1998 report by the GAO entitled Year 2000 Com- 
puting Crisis concluded that quote “federal agencies and state gov- 
ernments suggest that the full extent of the managerial and oper- 
ational challenges posed by the heavy reliance on others for data 
needed to sustain government activity is not yet known.” 

Congressman Steve Horn in his role as chairman of the House 
Subcommittee on Government Management, Information and Tech- 
nology, has issued another report card on Federal agencies with 
HCFA once again receiving an F grade. We fear that Federal and 
State government agencies will not survive the changeover to Year 
2000 without interruptions in health care reimbursements. Govern- 
ment reimbursement is only one area that could disrupt the flow 
of life sustaining prescription drugs to patients. Even if all parts 
of the prescription drug supply chain are compliant and ready, if 
there are failures in other links, it would be irrelevant that we are 
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ready. We need assurances that government agencies will be Y2K 
ready so they can seamlessly carry out their important functions. 

Wholesalers are making contingency plans to make sure that 
there is not a disruption in the availability of product. I want to 
emphasize that wholesalers are just one link in the chain. If the 
government agencies that play such a vital role in the health care 
system are not going to be Y2K compliant, contingency plans must 
quickly be completed and this information passed on to the public. 
How a business or industry develops its own backup plan depends 
on what government services will be available. 

NWDA and our member companies stand ready to work with 
government at all levels to address these issues to ensure that life- 
saving medicines continue to get to those who need them when 
they need them. Time is of the essence, and I thank the committee 
for holding this hearing today to address this momentous issue. 

[The prepared statement of Mr. Streck can be found in the ap- 
pendix.] 

Chairman Bennett. Thank you. The buzzer has just gone off. 
There is another vote on the Senate floor. This time I think I will 
go immediately and come back instead of run the clock the other 
way. Mr. Mallonee, I apologize for mispronouncing your name. We 
will hear from you as soon as we come back. The committee will 
stand in recess. 

[Recess.] 

Chairman Bennett. The committee will come to order. Mr. 
Mallonee, thank you for your patience. We will now hear from you. 

STATEMENT OF KEITH MALLONEE, VICE PRESIDENT, 
SYSTEMS DEVELOPMENT, McKESSON CORP. 

Mr. Mallonee. Mr. Chairman, thank you for inviting McKesson 
to participate today. I know you are all busy so I will keep my re- 
marks to about 3 minutes. My name is Keith Mallonee. I am vice 
president of Systems Development at McKesson. McKesson is the 
largest distributor of pharmaceuticals, health care products, medi- 
cal and surgical supplies in the United States with over $20 billion 
in annual revenue. We serve customers in all 50 States through a 
network, a national network of distribution centers. 

Our customers include independent pharmacies, hospitals, drug 
chain stores, food stores, clinics, nursing homes. We view the Year 
2000 as a critical business issue at McKesson. We are in the health 
care industry. We understand the importance in ensuring that a 
critical and potentially lifesaving product gets into the hands of our 
customers on time. We are also heavily involved in electronic com- 
merce. On a daily basis, we receive over 60,000 orders from our 
customers. We will fill over a million and a half order lines from 
our distribution centers. Over 99 percent of those orders come into 
us electronically. 

So we are approaching Year 2000 at McKesson like we approach 
any major business issue or initiative and that is with a dedicated 
team of personnel, resources, dollars, and senior management in- 
volvement and oversight. We began the project, the Year 2000 
product at McKesson, in 1996. We established a central Year 2000 
project office for all of McKesson, which I head. It is my full-time 
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job; it is my only job. It has been that way for 2 years and it will 
be that way for the next 18 months at least. 

And we did the right steps, as you have heard before. We did the 
assessment. We inventoried our systems. We identified our key 
business processes. We developed detailed project plans, and then 
we sort of divided the Year 2000 project into what I call manage- 
able chunks of work. We now have over 30 active Year 2000 project 
teams at McKesson. The majority of our systems have already been 
made compliant and we are in the final stages of taking care of the 
remaining software and hardware. 

We intend to devote next year to intensive integrated testing, 
and that testing will include customers and suppliers. In addition, 
we have instituted a very rigorous project control methodology at 
McKesson for Year 2000 with regular review meetings with senior 
management that goes right up to the board of directors. While we 
are pleased with the progress that McKesson is making, we under- 
stand we are heavily interdependent with other industries, indus- 
tries such as telecommunications, electric utilities, and transpor- 
tation. We do need for them to be ready as well so that we can get 
product to our customer. 

However, we are developing contingency plans. We are develop- 
ing plans that will ensure that we can get product to our customers 
in the event that there is a disruption in business due to Year 
2000. McKesson has been in business since 1833. During that time, 
we have faced numerous challenges in getting product to our cus- 
tomer. Hurricane Georges is a recent example of that situation for 
us. One of our distribution centers was closed because of the hurri- 
cane. But we have in place a backup system among our distribution 
centers. So we were able to reroute those orders from that distribu- 
tion center to other distribution centers to get the product to our 
customers. That is the sort of contingency planning we will lever- 
age as we go forward. 

Year 2000 is a serious issue and it needs to be taken seriously 
and McKesson does. We think we know what we need to do. We 
have got the steps in place necessary to get it done and to achieve 
what we consider our primary objective in all this which really is 
no impact, no disruption to the customer. I would like to thank 
again the committee for inviting McKesson to participate in having 
discussions on this vital issue. Thank you. 

[The prepared statement of Mr. Mallonee can be found in the ap- 
pendix.] 

Chairman Bennett. Thank you very much. Mr. Carbray, you get 
to be the cleanup hitter. 

STATEMENT OF RICHARD T. CARBRAY, Jr., GENERAL MAN- 
AGER, FELTON’S PHARMACY AND HOME HEALTH CENTERS 

Mr. Carbray. I would like to commend whoever put this lineup 
together because as you can see you have got a manufacturer down 
to wholesalers to the end product, the dispensers of the medication. 
Good morning, Mr. Chairman. My name is Rick Carbray and I am 
representing actually three groups this morning. I am representing 
the American Pharmaceutical Association as well as the Connecti- 
cut Pharmacists Association and individually as a small business 
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in Connecticut of three pharmacies in the central part of Connecti- 
cut. 

And basically what I would like to talk about today is how it af- 
fects us pharmacists at the local level. You have heard some com- 
ments certainly from the manufacturers. McKesson is a wholesaler 
for our company, a very fine wholesaler, and we have done some 
due diligence with a lot of our companies to ask them if they are 
ready for this problem, and McKesson has responded very favor- 
ably. So we feel fairly confident and in talking to Ms. West regard- 
ing her testimony and how this might affect us and her as far as 
delivery of medications. I feel more confident today now talking 
strictly to McKesson and to the NDWA and to Merck that we do 
have in the pharmaceutical industry many of these situations read- 
ily taken care of. 

What I do see, though, as far as a problem for some of us in the 
pharmacy industry is some of our systems where we in-house have 
already worked to get this compliance done. There are some sys- 
tems, not necessarily related to the dispensing of a prescription 
which is obviously our most important function, those systems I 
can honestly say to you right now from our vendors, they are say- 
ing that they will be compliant. We have checked our pharmacy 
system as of last month and we were able to fill a prescription 
dated February 1, 1999 with a refill date of 2/1/00. So that pre- 
scription would have gone through that computer so we feel con- 
fident there. 

We also are very involved in the whole home health area and ob- 
viously have concerns with those computers because now we also 
are tracking besides record keeping for pharmacy patients and 
medications and drug interactions, we are also tracking medical 
equipment and trying to do inventory control and billing. So we are 
looking to get compliance from those computer vendors also. An in- 
teresting situation that has just developed for us — it is more from 
a business standpoint, maybe not quite as much from the pharma- 
ceutical standpoint — is our point of sale computer for our registers. 

If we fill the prescriptions and we cannot collect for those pre- 
scriptions, obviously we will not be in business very long. Currently 
we have a vendor, a software vendor, who has provided us with a 
point of sale system who is going out of business, and it is interest- 
ing to note that they are going out of business because of the Year 
2000 problem. They have decided that it is too cost prohibitive to 
address that problem as a company for their customers and they 
are going to get out of that part of the business. So we have rough- 
ly a $100,000 piece of equipment that is going to be relegated to 
some hardware very shortly. 

We are in the process of working with other software vendors to 
hopefully assure us that we can upgrade that system to the tune 
of probably $40 to $50,000 in expense to become compliant. So 
again the pressures of a small business trying to stay viable and 
having to spend that kind of money. 

In summary, again I feel fairly confident in the pharmaceutical 
end. Our big brothers have come to the table and I am very con- 
fident that we will continue to be able to deliver the products. If 
I can just comment, Ms. West and I talked about having medica- 
tion available. A suggestion possibly to avoid some of the over 



39 


stockpiling on a huge basis which I could see happening if a scare 
like this were to come out, pharmacists have generally been able 
to take care of individual clients with extra amounts of medication 
at our expense inventorying those medications and keeping them 
on hand to ensure that those patients that critically need lifesaving 
medication can have them. So as a general rule, I do not think we 
should go towards across-the-board overstocking or oversupplying 
but try to focus on those critical areas and help patients like Ms. 
West have that medication available. And with this group here, I 
think you have a group that is committed to doing that. Thank you. 

[The prepared statement of Mr. Carbray can be found in the ap- 
pendix.] 

Chairman Bennett. So if I understand what you are saying 
about the overstocking, you are saying that at the pharmacy level, 
you identify critical substances and have an adequate supply of 
that instead of having to have each individual patient have an un- 
usual supply? 

Mr. Carbray. Correct. We can identify groups of patients 
through our system and whether it be an AIDS patient or be a kid- 
ney transplant patient to make sure that we have plenty of supply 
on hand for that particular group. If it happens to be a kidney 
transplant patient as opposed to — and it can be specific to a patient 
also certainly. You may only have one kidney transplant patient 
that needs that medication so we would ensure that that medica- 
tion is in ample supply although to be honest with you in most 
cases our wholesalers have an adequate supply. 

I think what we are trying to avoid is a scare that forces the sup- 
ply to change drastically and that people get an excess supply who 
do not necessarily need that excess supply and I think that could 
happen. 

Chairman Bennett. Dr. Popper, do you want to comment on this 
issue? I know pharmaceutical companies are concerned about the 
stockpiling challenge. One of the reasons for this hearing is to deal 
with what makes the most sense for consumers like Ms. West. 

Dr. Popper. Yes, I concur with the last comment that just stock- 
piling out of almost a panic situation is likely to create more harm 
than good, that it really distorts our ability to distribute product. 
Our position at Merck, actually even upstream of us, the companies 
that we get our raw materials from, the supply chain is very well 
engineered today and it is based on a certain expectation in terms 
of what supply is necessary in the marketplace and that ripples all 
the way back through the chain. If supply were to double or triple 
in the short-term, that kind of disruption to the supply chain could 
really, as I say, do more harm than good. 

What I think we need to do is study the problem a little more. 
As I mentioned in the testimony, the Vital Signs 2000 survey will 
give us some good data on where we may see sensitivities in the 
supply chain and where we may see some risk. And I think on 
more of a rifle shot approach, we can understand where we want 
to take steps. So whether it is in certain cases at the local phar- 
macy, in certain cases at the distributors, in certain cases at our 
warehouses, we can make sure that we have the situation covered, 
but rather than take an across-the-board solution, which could be 
counterproductive, I think we need to work from facts which we 
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have to gather over these next couple of months and then work out 
a plan that may entail some government help to make sure that 
we can get the cooperation together. 

This now moves us perhaps away from the standard marketplace 
forces and I do not know where that may lead quite frankly. I just 
want to make sure that we do is based on a real analysis of data 
as opposed to just fear and panic. 

Chairman Bennett. One of the functions of this committee is to 
see to it that accurate information about all aspects of Y2K re- 
places some of the myths that are out there and the myths go all 
the way from the article in Time magazine that was headlined 
“Apocalypse Not” that basically said there is no problem to the 
folks that are digging up their backyards and putting in propane 
tanks because they assume they will not have any power for 5 
years. And the best way to deal with both of those extremes of mis- 
information is hearings like this and witnesses like you that can 
give us that detail. 

Mr. Popper or Dr. Popper, Merck & Co. is probably about as 
international as an American company is going to get, both in 
terms of your supply chain coming in and your distribution chain 
going out. I assume you sat here and listened to the Gartner Group 
presentation. Do you have any reactions or comments on Gartner’s 
view of what is going to happen around the world? 

Dr. Popper. From a Merck perspective, we continually review 
the risks on a worldwide basis. In fact, last week I spent 2 days 
with my senior staff devoted to yet another exhaustive review of all 
of our Y2K programs including the business continuity planning. 
And we have pushed down into each of the geographies beyond the 
United States, Europe, Mideast, Africa, Far East, Asia, and each 
of the countries is engaging in a similar activity. 

So we are looking at the supply chain within each country and 
at our customer base in each country, the distribution chains, and 
doing what we need to in terms of contingency planning. So from 
a strictly health care perspective, we think we are engaged in the 
right level of planning to deal with the problem. 

What I cannot really comment on is whether there will be sys- 
tematic failures in some countries of the infrastructure. Our plan- 
ning assumption is that the more advanced countries that are more 
heavily computerized are typically further along in the planning 
stage. I think Gartner had some countries that I want to go back 
and double-check on because it sort of goes counter to that assump- 
tion, and then some of the countries where they are less developed 
there is actually less reliance on that infrastructure and that I 
think mitigates the risk. So that has been our approach to it and 
as I say, we will look at their data very carefully and make sure 
that there are no surprises there that we have to worry about. 

Chairman Bennett. Well, let me put on my CEO hat that I wore 
and say, all right, we are sitting in my corner office now and we 
are 6 months away from New Year’s Eve in 1999. I am saying to 
you, OK, doctor, it looks like Country X — I will not fill in the name 
here lest anybody get excited — is going to have insoluble Y2K prob- 
lems. You have been developing plans and I assume that means we 
start buying whatever someplace else. Is that, in fact, the kind of 
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conversation you are going to have with your CEO? If it is, do you 
have a list of someplace else? 

Dr. Popper. On the supply side, we have that covered on a 
worldwide basis. We have looked at every single supplier. We have 
categorized them in terms of criticality of the supply, uniqueness 
of the supply, and are dealing with that. Most of our production is 
focused in a small number of countries. We have 30 plants world- 
wide including I think about 8 in the United States. So it is on the 
order of 20, 25 plants outside of the United States and those are 
situated in places where we are pretty confident that the infra- 
structure will survive and we will not have any problem with that. 
So I think the bigger risk in the smaller countries is on our ability 
to supply downstream and the ability to distribute through the net- 
work then. 

Chairman Bennett. I see. You are concerned more about your 
customer chain that your supply chain? 

Dr. Popper. Exactly. 

Chairman Bennett. Well, I am coming back to the theme that 
I mentioned when I was talking to the small business group. The 
more this unfolds, the more convinced I am that we are going to 
see a flight to quality with corresponding dislocations on the part 
of marginal producers, marginal companies, marginal countries. 
Every one of these hearings teaches me something. I have now sat 
through I do not know how many with the combination in this com- 
mittee and the subcommittee that I chair on banking for financial 
services and technology. I guess we are approaching 20 hearings 
total; are we not? 18. All right. Well, in Washington-speak, that is 
20. And I learn something from each one. 

Sometimes I am reassured by what I learn. There are some 
things we have heard today that are quite reassuring. Sometimes 
I am more frightened by what I learn and there are some things 
we have learned today that are frightening. But I recently have 
come to the conclusion that as a result of Y2K, we are going to see 
significant shifts in where people go for materials, where people go 
for markets, and it will produce some very challenging social prob- 
lems all over the world. Then those countries and companies that 
survive and thrive as a result of the long-range planning that they 
have done will be called upon to provide aid and assistance in those 
parts of the world where challenges exist. I think the social impact 
of this is beyond anything we had previously thought it might be. 

CLOSING REMARKS 

I would like to thank today’s witnesses for their valuable con- 
tribution to our growing understanding of Year 2000 issues. 

Let me take just a moment before we close to quickly summarize 
the committee’s activities this session. In the 6 months of our exist- 
ence, we have accomplished a great deal. The committee has held 
nine hearings on critical infrastructure and industry sectors includ- 
ing energy utilities, health care, telecommunications, transpor- 
tation, financial institutions, general government, and today — gen- 
eral business. And against impossible odds, we also managed a bi- 
partisan effort that passed the Year 2000 Information Disclosure 
Act (S. 2392). In addition, our CRASH protection legislation (S. 
1518) forced the SEC to require meaningful Y2K corporate disclo- 
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sure to shareholders. This disclosure will help maintain faith in our 
markets, and ensure the availability of accurate Y2K information 
from publicly traded companies. 

Raising awareness, highlighting potential Y2K problems and 
prompting action on Y2K have been of central concern to the com- 
mittee. We have maintained a bipartisan approach to the commit- 
tee’s activities, and worked closely with the President’s Council on 
Year 2000 Conversion, as well as numerous industry groups. All of 
us have a common goal — to minimize the impact of this potentially 
devastating problem. 

While awareness of the Year 2000 problem is growing, we still 
have much work to do. Our research indicates that many organiza- 
tions critical to our safety and well being are not fully engaged in 
solving the problem. For example, over 90 percent of the doctor’s 
offices and 50 percent of the small and medium sized businesses 
have yet to address the problem. Like ostriches, they are burying 
their heads in the sand — unwilling to believe that the problem is 
real, or content to think that someone else will solve it. This com- 
placency is very dangerous. While larger firms have to some extent 
grasped how a Y2K failure could severely impact their future, 
smaller firms seem to be more focused on their immediate prob- 
lems. 

The findings of our committee do not just indicate a division be- 
tween small and large organizations. First, nearly all affected in- 
dustries and organizations started too late. As a result, most orga- 
nizations must exercise triage — focusing on what is critical to sus- 
tain the life of the enterprise as opposed to finding long-term solu- 
tions. Second, there are still no overall assessments of infrastruc- 
ture or industry sectors. Consequently, we still cannot answer the 
fundamental questions that everyone is asking — How bad will it 
be? Which systems are most at risk? And, what should I do person- 
ally to be prepared? Third, this is a global problem. That means 
that any business, government agency, or other organization that 
has international operations must pay attention to the affects of 
Y2K in other countries. If the United States is the leader in ad- 
dressing the Y2K problem, and the situation is as gloomy as it is 
here, then the prospects for the rest of the world are positively 
frightening. Fourth, if it becomes increasingly evident next year 
that we cannot finish the job, contingency planning will become 
even more criticalessential. Finally, the fear of legal liability, while 
it has stirred some to action, has discouraged organizations from 
openly sharing information. As a result, those trying to address the 
problem have found themselves inventing their version of the 
wheel instead of collaborating with their industry counterparts. 

Just last Thursday the Congress passed the Year 2000 Informa- 
tion Disclosure Act. Having received the administration’s proposal 
with only 25 legislative days remaining in this Congress, there 
were those that doubted our ability to pass this bill. It was a pleas- 
ure to prove them wrong! We are convinced that the Year 2000 In- 
formation Disclosure Act will encourage the exchange of Y2K infor- 
mation and, thus, give organizations invaluable access to informa- 
tion that they would not otherwise have had. This information 
should save companies precious time in their Y2K remediation ef- 
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forts, and greatly aid those companies who are grossly behind on 
their Y2K planning. 

While we are out of session and back in our home States, we will 
continue to work closely with our staff investigating potential Year 
2000 problems, pushing for assessments of our critical infrastruc- 
tures and researching the implications of international Y2K fail- 
ures. I look with guarded optimism toward 1999. We all must be 
relentless in our pursuit of the Y2K bug. We end this congressional 
session hoping for the best, but preparing for the worst. 

Thank you all very much. Again, I apologize for the somewhat 
disjointed fashion of this particular hearing, but it has been very 
useful and I am particularly grateful to those of you who are will- 
ing to come forward and share your information. The committee is 
adjourned. 

[Whereupon, at 12:38 p.m., the committee adjourned.] 




APPENDIX 


ALPHABETICAL LISTING AND MATERIAL SUBMITTED 


Prepared Statement of Chairman Robert F. Bennett 

Today marks the Committee’s ninth and final hearing this year. In all of our 
hearings we have strived to increase awareness, disseminate reliable preparedness 
information, and help facilitate solutions. This Committee has spent the last 6 
months trying to raise public awareness of this oncoming challenge. Despite our 
best efforts, recent polls tell us that only 30 percent of our fellow Americans have 
heard about the year 2000 problem. Only 450 days stand between us and the new 
century. Our work — the work of everyone participating in this hearing today — be- 
comes more urgent with each passing day. 

General business — the subject of today’s hearing — is a term that encompasses the 
spectrum of American commerce ranging from over 5 million small firms at one end 
of the spectrum to global corporations at the other end. All of these companies face 
Year 2000 challenges — from the PC’s and networks automating their offices to their 
dependence on credit card transactions, just-in-time inventory supply systems, Elec- 
tronic Data Interchange (EDI) transactions, and other technologies. One of today’s 
witnesses warns that over 700,000 small firms are at risk of either closing their 
doors or being severely crippled by Y2K problems. 

Global corporations face complex problems because of their dependence on thou- 
sands of suppliers, distributors, and customers, both domestically and internation- 
ally. They must be concerned not only about the Y2K readiness of these business 
partners, but the infrastructure of the countries where they reside. Today, the 
Gartner Group is releasing some alarming new research data which shows that 66 
percent of the companies in critical industries such as healthcare and food process- 
ing will likely experience at least one mission critical systems failure. In addition, 
50 percent of the companies in critical trading partner countries such as Germany, 
Japan, Saudi Arabia, and Venezuela will experience similar failures. If these pre- 
dictions are correct, Y2K could deliver a devastating blow to an already troubled 
global economy. 

I would like to relay an example that shows how even the smallest of businesses 
are completely reliant on technology, and, thus, highly susceptible to Y2K risks. Re- 
cently, an acquaintance cracked his car windshield. He replaced it by calling his in- 
surance company whose national computer directory located a local glass installer 
for him. This two-employee business received an electronic purchase order from the 
insurance company authorizing the replacement of the windshield. The glass in- 
staller in turn compared the year and model number of the car to his database in 
order to place the appropriate EDI purchase with a large supplier of windshields. 
When the windshield was installed on site at my friend’s home, less than 24 hours 
later, my friend marveled at the efficiency of the process. The small businessman 
replied that his company, like most others is striving to improve service and reduce 
costs. 

For exactly that reason, small businesses, like the one in this example, depend 
heavily on EDI to eliminate paperwork and reduce transaction time. Electronic pur- 
chase orders, inventory control and payments processing are greatly facilitated by 
EDI. This story also highlights the critical role that just-in-time inventories play in 
many small businesses. Unlike their large, corporate counterparts, small businesses 
cannot afford to store and maintain the thousands of non-standard parts and sup- 
plies. While EDI makes just-in-time inventories possible, the use of this and other 
technologies heightens our concern about the impact of Y2K, and, thus, the viability 
of America’s businesses. One recent study estimates that over 600,000 firms are at 
risk of either close their doors or be severely crippled by Y2K problems. 

( 45 ) 
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This micro example of modern commerce demonstrates not only the central role 
that technology plays in today’s commercial world, hut also the mutual dependency 
of large and small businesses. To small businesses, we offer this caution from the 
editor of CIO magazine, a witness at our recent Telecommunications hearing. He 
stated, “Large companies are starting to perform Y2K triage work with their part- 
ners connected in massive EDI or other telecommunications networks where they 
are abandoning entirely those companies not essential to their critical business proc- 
esses that may not be Y2K compliant.” This is a real and present danger that small 
firms must address. When the first EDI transaction is placed on January 3rd of the 
year 2000 the small business on the receiving end may only have one opportunity 
to respond. If it fails to do so, the competitive environment will quickly force that 
small firm out of business. 

As we examine each industry in detail we are discovering that inter-connectivity 
among businesses is one of the most difficult Y2K issues to address. You can be 
ready for the Year 2000, but your key business partners may not. In addition, any 
break in the electronic link between you and your partners both here or abroad 
could be equally disruptive. Companies must assess these issues and find alter- 
native partners if they are to remain viable after the Year 2000. 

The frustration that Vice Chairman Dodd and I share along with the other mem- 
bers of this Special Committee, is that many of those who are dragging their feet 
on the Y2K issue defend their lack of activity on the perception that we lack ade- 
quate information to justify serious action. Perhaps 6 months ago we were flying 
blindly into the year 2000, but thanks to the many publicly-spirited Americans who 
have testified before this Committee, patterns are emerging. We do not need abso- 
lute, 100 percent certain evidence for us to recognize that we have a serious Y2K 
problem any more than a citizen of Key West or Mobile needed the National Weath- 
er Service to tell them that they were in the middle of a hurricane. The Weather 
Service did, however, provide an absolutely invaluable function by warning of the 
oncoming danger. Like the Weather Service, this Committee cannot provide an abso- 
lute prediction of the future. We cannot know what will happen on January 1, 2000. 
We can, however, provide a real and useful warning for individuals and industries, 
and that, after all, is one of the most important aspects of our work. 

Our hearing today is intended to be a catch-all for general business Y2K issues — 
from small businesses to global corporations. We have a panel to represent small 
business concerns, and a pharmaceutical industry panel to represent articulate the 
Y2K problems facing global corporations. We welcome today’s witnesses and thank 
them in advance for their contribution to this extremely important issue. 


Prepared Statement of Richard T. Carbray, Jr. 

Good morning. Mr. Chairman and Members of the Committee, thank you for the 
opportunity to present the views of pharmacist caregivers across the country on the 
impact of the “Year Two Thousand” (Y2K) problem on the pharmacy profession and 
the patients we serve. I am Richard Carbray, a pharmacist, and I am speaking 
today on behalf of the American Pharmaceutical Association (APhA), the national 
professional society of pharmacists, and the Connecticut Pharmacists Association. 
This topic is important to me and my profession for one central reason: perhaps 
more than any other part of the health care industry, pharmacy is the most reliant 
on computers for nearly every component of day-to-day activity. 

Pharmacists rely on computer technology to maintain patient drug therapy 
records, identify potential drug interactions, and provide clinical information about 
medication use. Computers are used to print out relevant patient information about 
prescription medications at the time of dispensing in community pharmacies, used 
to track drug therapy within the hospital and long-term care facility, and to submit 
claims for third party payment. Nearly every one of the more than two billion pre- 
scriptions dispensed in tbe United States is prepared with the assistance and sup- 
port of a computer. Pharmacists will directly feel the impact of any failure in these 
systems due to the Y2K problem. The issue this Committee addresses today will 
have some relevance for nearly every one of the 118,000 pharmacies located in com- 
munities, hospitals, and home health clinics in the United States, including more 
than 40,000 retail pharmacies. 

USE OF COMPUTERS IN PHARMACIES 

Pharmacy is likely the most computerized segment of the health care industry, 
with an estimated 99 percent of prescriptions dispensed using computers. Let me 
quantify this for you: in 1995, prescriptions filled in retail, long term care and mail 
service pharmacies totaled more than 2.3 billion. This does not include prescription 
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medications dispensed in hospitals and other settings. With advancements in medi- 
cation therapy and increasing reliance on these agents, these numbers will only in- 
crease and increase the use of computers in these settings. Most pharmacies use 
computers for virtually every aspect of day-to-day operation. For example, in any 
given pharmacy there may be different systems to track sales and inventory and 
maintain patient profiles, check for drug interactions, track prescription refills and 
maintain patient records. 

In addition to this use within the pharmacy, on-line, real-time transmission of 
claims for third-party coverage of prescription drugs is a normal component of phar- 
macy practice. The claim for third party coverage of the prescription is transmitted 
to a claims processor, such as a State Medicaid agency, for on-line, real-time review 
of the prescription to confirm eligibility of the patient for coverage and conduct some 
drug utilization review activities. In 1996, more than one billion prescription claims 
were processed in this manner, supported by the industry telecommunication stand- 
ard as developed by the National Council for Prescription Drug Programs. 

CHALLENGES WITH YEAH 2000 COMPLIANCE 

Like many other health professions, pharmacists rely on outside software vendors 
to develop and maintain the various operating systems used by the pharmacy. Many 
vendors have indicated that their products are Year 2000 compliant, but what as- 
surance does the pharmacist have? This uncertainty, likely typical of many ap- 
proaching this daunting problem, places the pharmacist in a somewhat vulnerable 
position — he or she must trust that the software is compliant, but will not know for 
sure until the first prescription is entered that could trigger a problem. An error 
in the in-store system or in the third-party processing system will likely stop 
progress on preparing that patient’s medication, and likely cause delays for other 
patients. At a minimum, concern about these problems and dealing with them as 
they arise will distract these health care professionals from their core function — 
working with patients to make the best use of their medications — to focus on chal- 
lenges with the systems designed to support that practice. 

The problems for pharmacy will not wait for January 1, 2000, either. Many phar- 
macists will confirm or discover their challenges with Y2K compliance in early Jan- 
uary of 1999. Let me explain. Most prescriptions for chronic medications, like a drug 
to control high cholesterol or blood pressure, are valid for one year. In entering a 
new prescription into the pharmacy operating system, an expiration date for the 
prescription is also entered. When Mrs. Smith brings in her prescriptions on Satur- 
day January 2, 1999, I will know pretty quickly if the system is compliant. If it is 
not, the expiration date of January 2, 2000, will cause an error and reject the pre- 
scription. 

This is not, however, the first time the profession of pharmacy has faced date- 
related challenges. In the early stages of computerization end expansion of clinical 
systems to support pharmacy practice, the inclusion of patient birth dates provided 
necessary information to confirm patient identity and focus clinical information pro- 
vided to the pharmacist. Communicating the birth date of patients born in the late 
1800’s created a preview of the expiration date problem we expect. Obviously, a 
birth year reflected by “87” and interpreted as a birth year of 1987 will yield dif- 
ferent clinical recommendations than the more accurate birth year: 1887. This prob- 
lem was addressed at that time for the birth year, and we hope all Y2K problems 
will also be addressed. Pharmacists may have varying comfort levels that the sys- 
tems have dealt with the problem before, but are concerned about the impact on 
other data fields, such as the expiration date. 

EXTERNAL COMPUTER SYSTEMS 

Beyond the operating systems within a pharmacy, pharmacists must also rely on 
the compliance efforts of a number of systems involved in processing claims and 
third party payments. To secure third party payment for prescription medications, 
the information is transmitted from the pharmacy system to the system of the third 
party payer — often through a “switch” to direct the information. Some of this infor- 
mation stays within the originating state, for processing by the State Medicaid pro- 
gram, for example, but other information may pass through a company located in 
a city hundreds of miles away, and then onto its final destination in yet another 
system located in yet another state. The claim is then processed at the remote loca- 
tion — verifying patient eligibility, coverage for the specific product, and some utiliza- 
tion review procedures conducted. Approval for payment and/or relevant clinical or 
administrative information is then transmitted back to the pharmacy. 

This process occurs on-line, in real-time at the pharmacy — literally while the pa- 
tient is waiting for their prescription. Any glitches in the system from the third 
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party processors or the switch company will create problems in my pharmacy — and 
delays for my patients. Again, this diverts my attention from clinical activities and 
patient education to trying to release the prescription and verify coverage and pay- 
ment. I communicate with a number of third party processors every day, and must 
rely on those companies to ensure Y2K compliance. 

In this overview, I have not even begun to address the additional challenges cre- 
ated in other areas of my pharmacy outside of the prescription dispensing area. 
Similar to other small businesses, I must also be concerned about challenges with 
credit card processing, inventory control systems, and the myriad of other computers 
with which I work every day. 


CONCLUSION 

The impact of Year 2000 compliance will be felt in many areas of pharmacy prac- 
tice — the retail side with the cash registers and inventory programs, in the home 
health care and durable medical equipment area, and for prescription processing 
and record-keeping. Beyond the challenges in one’s own pharmacy, there is inter- 
action with other computers constantly — and pharmacists must trust that those sys- 
tems will be compliant. 

Pharmacy will experience the impact of glitches in Year 2000 compliance sooner 
than other health care providers, with January 1 of 1999 the first date for potential 
problems. We are working to alert pharmacists to check on the compliance of their 
systems — and take action to avoid problems. Thank you for conducting this hearing, 
and for listening to the concerns of the nation’s pharmacists. 


Responses of Richard T. Carbray, Jr. to Questions Submitted by 
Chairman Bennett 

Question 1. The monitoring of expiration dates is an important safety control in 
the pharmaceutical business. What are the Y2K vulnerabilities of your business in 
the area of inventory control? 

Answer. The absence or delay in providing expiration dates on drug products 
would certainly affect inventory levels in that drug products with slower movement 
would require additional re-order processing to ensure full potency. Although this 
would not necessarily require more amounts of drug product in stock at one time, 
the frequency of ordering would certainly increase. 

Question 2. Drug interaction information and patient drug sensitivity information 
are an important part of pharmaceutical records. What is the potential impact of 
Y2K in this area? 

Answer. If the clinical information regarding patient drug therapy is restricted or 
unavailable, there will be significant impact on the pharmacists’ ability to not only 
dispense medication, but also to consult with patients as to the proper use of that 
medication, particularly if potential drug interactions exist. If these systems are not 
in place it would be virtually impossible to provide drug products to a patient in 
a timely and precise manner. The checks and balances of the information available 
in the data base is critical to proper medication dispensing. 

Question 3. What are the electronic data interchanges do you rely on for the re- 
ceipt and transmittal of information in your business? What vulnerabilities do you 
see in this area? 

Answer. Currently almost 65-70 percent of all prescriptions dispensed are covered 
under some form of insurance company (private. Medicare, Medicaid, HMO). Since 
99 percent of the prescriptions filled are done through computer, pharmacies must 
rely on third party claims processors for on-line, real-time review of the prescrip- 
tions filled. In 1996 over 1 billion prescriptions were processed in this manner, sup- 
ported by telecommunications systems, the vulnerability is that the pharmacist 
must trust that these vendors have complied with the Y2K requirements. The result 
of non-compliance leaves the pharmacist with no adjudication of the claim and the 
patient without the medication. 

Question 4. As a customer, what are your main concerns regarding the Y2K readi- 
ness of pharmaceutical manufacturers? 

Answer. The overall concern would be that manufacturers would not be able to 
supply pharmacies with the needed drug product for our patients. A huge potential 
for stockpiling by larger chains and mass merchandisers could cause a supply short- 
age and impact the ability of smaller pharmacies to get the needed products for 
their patients. 

Question 5. What is your reliance on foreign produced pharmaceutical products? 
How does this reliance factor into your risk assessment related to your Y2K expo- 
sure? 



49 


Answer. Currently our company has a very small volume of foreign produced 
pharmaceutical products. However, there are some manufacturers who have foreign 
subsidiaries which could affect some product flow if a problem arose. Although we 
have some concern we will rely heavily on the U.S. manufacturers to ensure that 
product is available. 

Question 6. We’ve heard earlier today that one effective way of reaching small 
businesses is through their trade associations. The web page for the American Phar- 
maceutical Association (APhA) states that APhA represents 50,000 pharmacists, 
pharmaceutical scientists, etc. However, we could not find any reference on this web 
site to Y2K or Millennium Bug. What can Congress or the government do to in- 
crease Y2K awareness and encourage greater outreach on the part of trade associa- 
tions? 

Answer. I think that trade associations are an excellent way of disseminating in- 
formation regarding issues like the Y2K problem. I have received information from 
APhA on this issue and feel that they have been diligent in notifying members of 
this situation. Congress should continue to contact trade associations for their input 
on these issues. The associations in turn will filter down the information to its con- 
stituents. Requests from Congress to associations for individuals to present testi- 
mony certainly is valuable. The lines of communication must flow in both directions 
to be sure. 


Prepared Statement of Senator Susan M. Collins 

I wanted to first thank you Mr. Chairman for your continued leadership on this 
critical issue facing our nation. Over the past four months, this Committee has ex- 
amined vital areas of our country’s technology infrastructure. 

We started in June with our utilities hearing, and since that time the Committee 
has focused on telecommunications, banking/finance, transportation, and emergency 
preparedness. But of all the hearings we have held, today’s hearing, with its focus 
on Y2K’s impact on business, and especially small business, might be our most im- 
portant. 

Our nation’s 23 million small businesses create two out of every three new jobs, 
represent over 99 percent of all employers, and are responsible for more than half 
of the nation’s technological innovation. In my home State of Maine, they are the 
backbone of our economy. 

While we have received assurances of other industry sectors’ preparedness for 
Y2K, there is great concern about small business. Many small businesses are having 
difficulty in determining how they will be affected by Y2K and what they should 
do about it. Many of them face not only technological but also financial challenges 
in becoming Y2K-compliant. Most of all, they need practical information about what 
to do. 

The good news is that information resources are available for small businesses to 
assist them in figuring out what to do. In fact, I wanted to welcome two people who 
know how to help small businesses and are working every day to tackle the Y2K 
problem. First of all, I wanted to welcome Fred Hochberg, Deputy Administrator of 
the Small Business Administration, an organization I am very familiar with having 
served as its New England Administrator during the Bush Administration. 

Mr. Hochberg joined Senator Snowe in Maine in August rolling out his agency’s 
“Are You Y2K OK?” program, encouraging the small businesses in my State to iden- 
tify potential Y2K problems, take action on them, and stay informed about new de- 
velopments. This is an excellent outreach program, and I commend the SBA for its 
leadership role on Y2K. 

I also wanted to welcome Rod Rodrigue from Maine. I had the opportunity to meet 
with Rod last month in my of floe and was impressed by the tremendous amount 
of knowledge and energy he brings to this issue. Thanks to his leadership, the 
Maine Manufacturing Extension Partnership has taken the initiative in reaching 
out to small businesses to help them cope with the Y2K challenge. 

The Maine MEP uses a diagnostic software tool to assist businesses in identifying 
specific Y2K problem areas and then provides a road map for businesses to find fur- 
ther information in their Y2K remediation process, including links to SBA loans if 
necessary. Congress should take a very close look at this model program funded 
through the National Institute of Standards and Technology and the Department of 
Commerce. 

Mr. Chairman, by their very definition, entrepreneurs are risk managers. In the 
years that I have been working with small businesses, I am aware of countless expe- 
riences where the entrepreneurial spirit has propelled business owners to overcome 
major obstacles to succeed. 
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While we will hear about reasons for concern about small businesses and Y2K in 
today’s hearing, we should not lose sight of their ability to adapt. Coupled with tools 
and resources from organizations like the SBA and Maine MEP, it is my expectation 
that small businesses will succeed in solving their Y2K problem. I look forward to 
learning more from today’s witnesses about how the federal government can assist 
in achieving this goal. 


Prepared Statement of William J. Dennis, Jr. 

Thank you, Mr. Chairman, for the opportunity to present evidence on the pre- 
paredness of small business owners for the Y2K problem. The bulk of my testimony 
consists of the attached report. It outlines and quantifies the status of small busi- 
ness owner preparedness as of late April. These data will be updated later this 
month meaning that new numbers will be available around the first of December, 
perhaps sooner. 

My judgement is that the late October/early November update will be more en- 
couraging than last spring’s baseline. A year and one-half, i.e., the time between the 
baseline survey and January 1, 2000, can be an eternity to a small business owner. 
Immediate problems are usually those tackled first. As we near the critical date, I 
anticipate Y2K will begin to move up the priority scale. However, this is speculation 
based on experience rather than the statistical evidence NFIB will soon be collecting 
again. 

The critical finding from the April survey is that just over 80 percent of small em- 
ployers in the United States are exposed to a possible Y2K problem through their 
computers. A non-mutually exclusive 35 percent believe that they have devices with 
embedded chips. Despite this extensive exposure, a majority of small business own- 
ers plan no action. 

Think of the small employer population as divided into fifths. One-fifth has taken 
action or is in the processing of taking action on Y2K. One-fifth plans to take action 
prior to January 1, 2000, but has not yet done so. Two-fifths have not taken action 
and do not plan to do so. And, the final fifth has not heard of Y2K. 

At one extreme are the one in five small employers who do not need to take direct 
action. No equipment in their businesses exposes them. Their concern rests with 
others, e.g., their suppliers, their financial institutions, their utilities, etc. Joining 
them are another one in five who are in the process of resolving any problems they 
may have. The result is that about 40 percent of the population now appears to be 
clear of direct problems. 

Should nothing change, approximately 330,000 businesses will inhabit the other 
extreme. They will have to shut down for all intents and purposes on January 1, 
2000, and stay closed until their Y2K problem is fixed. These firms are exposed, 
would suffer an 85 percent or more loss of production or sales should their comput- 
ers malfunction, and whose owners in April planned no action. The severity of the 
individual impact will depend the speed and the cost of rectifying the problems, and/ 
or the costs of alternative production or sales systems. Small employers in this situ- 
ation must understand, however, that the supply of people who can correct Y2K 
problems are limited and that on January 1, 2000, the demand for their services 
(and their fees) will be great leaving these business owners at the end of the line. 
I must emphasize that this is a worst case scenario. It means that serious malfunc- 
tions occur in all of the firms possessing the characteristics outlined above. That al- 
most assuredly will not happen, but it clearly suggests the potential impacts are not 
trivial. 

A majority of small businesses fall in the middle. They may be impacted and if 
they are, some damage will ensue. But, the damage will not cripple the operation. 
Still, this group, too, will require people who can solve Y2K problems. And, they too 
will have to wait in line and pay dearly to get them. 

Aside from liability and an assumption that the credit markets don’t suddenly “go 
into the tank,” the Federal government’s role toward small business should prin- 
cipally be one of the village nag. Washington should use its pulpit and encourage 
others to do so as well. Let me point out that the SBA’s Office of Advocacy spon- 
sored research (How Small Businesses Learn) in 1994 that outlines the most effec- 
tive means for government to communicate with small business owners. I can find 
no evidence that anyone outside Advocacy and a handful of others have ever read 
the report. But it offers useful insights useful for the present situation. 

“How Small Businesses Learn” documents that government isn’t particularly cred- 
ible with small business owners nor are it communications. However, industry-spe- 
cific trade associations are and their literature is read. Moreover, industry-specific 
trade associations have some knowledge of the specific equipment used by busi- 
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nesses in the industry. Many of these groups can, therefore, identify and offer sug- 
gestions on embedded chip problems that those outside the industry almost cer- 
tainly cannot. Suppliers and business associates are another source of credible infor- 
mation. Larger firms and financial institution are now often asking their customers 
about Y2K “compliance.” The certain effect of these actions by business associates 
is to make small business owners increasingly aware of the problem and the seri- 
ousness with which their peers people take the problem. 

The upshot is that government might do well to focus its pulpit activities on lead- 
ers of trade groups and larger businesses with large supplier networks. They reach 
deeply into the small business community are have notable credibility. While they 
do not reach everyone directly, they do reach a critical mass. 

I would be remiss in failing to explicitly mention the contribution of the Wells 
Fargo Bank in the Y2K activities outlined. Wells Fargo has underwritten NFIB’s 
small business Y2K surveys and has prepared a Y2K booklet for small business 
owners. Copies of the booklet are available for the committee and staff. 


Small Business and the Y2K Problem 

[William J. Dennis, Jr., NFIB Education Foundation, May 26, 1998] 
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— Automated Processes 
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The Wells Fargo Bank sponsored the research on which this report is based. 

1. INTRODUCTION 

More than eight of 10 (82 percent) small businesses face direct exposure to a Year 
2000 (Y2K) problem. Eighty-one (81 percent) of their owners say that they are 
aware of it. However, fewer than one in four (23 percent) consider Y2K a serious 
problem. This gap between exposure and perceived problem severity is not nec- 
essarily inconsistent. A timely, measured response to a looming problem is the opti- 
mal method of resolving difficulties. Yet, just 41 percent have taken action or plan 
to take action to address the potential Y2K problem. The resulting interval between 
exposure and plans to address the potential problem has adverse implications for 
small business owners. If the experts are correct about the consequences of Y2K and 
small business owners are not prepared, many could face significant repercussions 
that, at a minimum, will make their business lives uncomfortable. 

2. MOST SMALL BUSINESSES EXPOSED TO Y2K 

The Y2K problem is located in computers — hardware and software, timing/dating 
mechanisms, and various types of automated equipment. Not every computer in op- 
eration nor every piece of software, nor every timing/dating mechanism will yield 
a Y2K problem. However, it is not always possible to easily determine which devices 
contain the problem and which don’t. The small business population that will be (or 
would be) impacted — in contrast to the potentially impacted or exposed population — 
is not obvious. 

The same is true for the organizations with which a small business transacts its 
affairs. These business partners may be large or small, profit or non-profit, public 
or private. But since these entities face the same Y2K problem, and since it takes 
at least two to conduct a business transaction, the effect of Y2K on any individual 
business is a function of the individual business’s problem as well as the problems 
of its partners. 
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2.1 Direct impacts 

Eighty-two (82) percent of small business owners ^ are exposed directly to the Y2K 
problem. Exhibit 1 presents the sources of exposure. It includes the percent of small 
business owners who use at least one computer in their businesses (78 percent), the 
percent using other equipment or devices that might be impacted (34 percent), and 
the percentage selling, leasing, or installing equipment that could be affected (11 
percent). These categories are not mutually exclusive. Exposure overlaps in many 
organizations. The “Not Exposed” category on Exhibit 1 quantifies the percentage 
of firms which appear to have no direct exposure. This 18 percent of firms possess 
none of the suspect equipment nor do they sell/lease/install any of it. 

The large majority of small employers, an estimated 4% million, are exposed to 
the Y2K problem. Computers are the primary reason. Virtually every firm facing 
Y2K has an exposure through its computers. Other devices and equipment increase 
the total exposed by only four percentage points. ^ The final exposure category comes 
in those firms which sell devices and products that may contain the Y2K problem. 
These firms appear liable for their products and services, not just for replacement 
or repair, but for the damage a malfunctioning product might cause. Virtually all 
the firms in this category fall in at least one of the other two categories as well. 

EXHIBIT 1. — PERCENT OF SMALL BUSINESSES WITH DIRECT Y2K EXPOSURE BY SOURCE 

OF EXPOSURE 



Larger small firms are those most likely to be exposed. Businesses employing 25 
or more people use computers almost universally. They are also more likely to pos- 
sess other timing/dating devices (46 percent) and to sell, lease or install products 
with potential exposure (19 percent). Small business owners employing 1-4 people 
lie at the other extreme. Only 70 percent of this group use computers in their busi- 
nesses, and their potential exposure in other ways is proportionately less as well. 
Still, 2% million of these small employers face a potential impact. The same phe- 
nomenon appears when substituting annual gross sales as the measure of size (Ex- 
hibit 2). About %’s of those grossing less than $250,000 are exposed. Once revenues 
reach $600,000, everyone is exposed for all intents and purposes. 

Exposed small businesses are also more likely to be located in metropolitan areas 
than in rural areas (Exhibit 2). Just, eight percent of firms in metropolitan areas 
(defined as city and surrounding suburbs with 500,000 or more) are without comput- 
ers in their businesses compared to 37 percent in rural areas (defined as community 
of less than 5,000 or a rural area). The survey contains four geographic size meas- 
ures. The frequency of computer use grows in every category as the resident popu- 
lation becomes larger. 

Other demographic characteristics of the business and/or the owner show no rela- 
tionship to the Y2K problem. 


iThe survey covers only those who employ other people. It does not include self-employed in- 
dividuals who employ no others. The Y2K problem of the six million full-time self-employed 
without employees probably resembles that of the smallest employers, and is in addition to it. 

2 The other equipment and devices category presents definitional problems for those de signing 
the questionnaire as well as for respondents, and therefore is the response most likely to contain 
bias (though in which direction we do not know). The difficulty probably has little impact on 
the estimate of total firms exposed since computers make most firms exposed in any event. The 
difficulty arises in quantifying the nature of exposure. 
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EXHIBIT 2.— EXPOSED SMAEE BUSINESSES BY ANNUAL GROSS SALES AND URBAN/RURAL 

DESIGNATION 


Exposed Exposed 

Annual gross sales to Y2K Urban/Rural to Y2K 

(percent) (percent) 


<$250,000 67 

$250,000-$499,999 87 

$500,000-$999,999 96 

$1,000,000-$!, 999, 999 95 

$ 2 , 000 , 000 + 100 

No Answer 96 

All Businesses 82 


Metropolitan 

(500,000 + ) 92 

Large oity (50,000- 

500,000) 86 

Small city (5,000- 

49,999) 76 

Rural (<5,000) 67 

No answer 100 

All businesses 82 


2.1.1 Size of the direct impact 

Exposure to a Y2K problem does not necessarily translate into serious problems. 
A piece of equipment lost for a day or two may be more of an inconvenience than 
a serious liability. Exposed small business owners on average estimate that one- 
quarter (24 percent) of their sales or production would be lost for the period that 
affected equipment or devices did not operate. That impact estimate is consistent 
across size and geographic area, with the production industries, i.e., construction 
and manufacturing, impacted marginally less than services. An affected business, 
grossing $750,000 annually, could expect to lose $3600 or 0.5 percent of sales di- 
rectly if a Y2K problem took one week to resolve. Indirect losses, such as good-will, 
are more difficult to calculate, but would add to the total. 

The impact estimates diverge wildly among firms. Seven percent would have to 
virtually shut down if, as forecast, these small business owners experience impacts 
at 91 to 100 percent of sales or production. Another eight percent gauge impacts 
between 71 and 90 percent. Those figures translate into over 330,000 businesses 
shut down and a slightly larger number crippled. But 330,000 is the worst case and 
assumes that everyone exposed is impacted. Everyone exposed will not be impacted 
as many in the group will take preventive measures and others will prove to have 
non-affected equipment. Yet, only one-quarter of the group who believe that their 
sales or production would be down by 71 percent or more if their systems malfunc- 
tion have taken action though another 40 percent plan it. These latter figures are 
based on a very small n (n=52) and therefore must be used with considerable cau- 
tion. But the numbers do suggest that far from all who attach significant depend- 
ence to their computer and automated systems are convinced that Y2K is worth ad- 
dressing. 

Forty (40) percent of the directly exposed owners estimate their sales or produc- 
tion would be impacted by less than one percent. This group will bear any impact 
of Y2K through the cost side only, at least initially. Handwork will substitute for 
computers or other automated processes. For example, payroll checks may have to 
be individually handwritten rather than produced automatically. Such substitution 
will add to costs. (The survey captured no data on the size of these costs, though 
they obviously could range substantially.) Added costs at some point must be passed 
on in the form of higher prices. Higher prices make affected businesses less competi- 
tive which can subsequently impact sales or production. 

The unknown variable is the length of time impacted businesses will “be down.” 
Affected devices will malfunction 9/9/99 or 1/1/00. Unfortunately, everyone’s Y2K 
problem will occur at the same time. A limited number of people will be capable 
of detecting and fixing the conditions, at least the more serious ones. Demand for 
these experts will exceed supply. Their fees will rise sharply. Even then these ex- 
perts may not be available for some time. The alternative is to have the owner or 
an employee do the work. The success of this latter strategy will vary enormously. 

The more businesses impacted by the Y2K problem, the greater the number of 
small business owners who will face “down-time.” Small business owners, therefore, 
have an interest in having as many businesses as possible resolve their Y2K prob- 
lems early. 

2.1.2 Types of activities affected 

Several business functions could be adversely affected by a Y2K malfunction. For 
example, 21 percent of small business owners report that their business is “very de- 
pendent” on automated processes. Another 27 percent say they are “somewhat de- 
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pendent” on them. Many of these processes require timing/dating devices or comput- 
ers. Automated processes are now spread throughout the economy and their mal- 
functioning would have wide repercussions. These processes are commonly associ- 
ated with the manufacturing industry. The survey sample included too few manu- 
facturers to report separately. However, the production industry of which manufac- 
turing is an important component was the industry least likely to be dependent on 
automated processes. Both the distribution and service industries appear more de- 
pendent on them. 

Malfunctioning computers also could severely impact small businesses. Exhibit 3 
presents the frequency with which small business owners use computers for selected 
functions. The striking point of Exhibit 3 is the dependence on computers to perform 
multiple functions within the firm. In fact, small businesses with computers use 
them to perform an average of 5V2 functions. Administration, record-keeping, and 
word processing is the most common application; operating machinery or equipment 
is the least. 

EXHIBIT 3.— USE OF COMPUTERS FOR SELECTED BUSINESS FUNCTIONS AS A PERCENT OF SMALL 
EMPLOYERS WHO OWN COMPUTERS AND ALL SMALL EMPLOYERS 


Function 


Billing/Accounts Receivable 

Inventory Control 

Acoounting/Gen. Ledger 

Payroll 

Admin/Record-Keeping/Word Processing ... 

E-Mail/Internet Access 

Customer — Prospect Lists/Sales Tracking 

Design/Prodiict Development 

Operating Machinery/Equip 

Check Reconciliation 


Computer Owners 
(percent) 


74 

41 

76 

45 

84 

61 

70 

28 

20 

51 


All small employers 
(percent) 


57 

32 

59 

35 

65 

47 

54 

22 

15 

40 


Software makes a computer run. It is generally believed that standard, off-the- 
shelf software packages are more likely to be free of Y2K problems than is custom 
software. A potentially important consideration and area for small employers to in- 
vestigate then, is the kind of software they are using. Almost two of five owners 
who employ computers (39 percent) claim that at least half of their software is cus- 
tom; 65 percent say that they use at least some custom products. Just 38 percent 
report that they use off-the-shelf software exclusively. The significant use of custom 
software in the mix magnifies small business exposure. 

It is highly likely that more problems are buried in older software. In this sense, 
small business owners are in good position. Eighty-one (81) percent have updated 
their most critical software in the last two years. Only a handful have not updated 
in more than five. Owners of larger, small firms are more likely to have modernized 
than are the others. 

2.2 Indirect Impacts 

It takes two separate entities to make a business deal. Even if a small business 
does not have a Y2K problem, the other partner in the transaction may. The part- 
ner’s problem may, therefore, force interruption or cancellation of a deal. Exhibit 4 
examines some of these linkages and their subsequent problems. It shows that 75 
percent of those with a computer (59 percent of small business owners) deal elec- 
tronically with important business partners. Fifty-four (54) percent of small busi- 
ness owners with a computer (42 percent of the small business population) interact 
electronically with their suppliers. Eighteen (18) percent interact with them a lot. 
Thirty-five (36) percent of those using a computer electronically interact with their 
primary financial institution. Fourteen (14) percent interact a lot. Finally, 49 per- 
cent of small business owners with a computer interact electronically with their cus- 
tomers. Seventeen (17) percent do so frequently. Each of these are points of expo- 
sure to the Y2K problem could doom a potential transaction. 
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EXHIBIT 4. — PERCENT OF SMALL BUSINESSES WITH INDIRECT Y2K EXPOSURE BY SOURCE 

OF INDIRECT EXPOSURE 



The indirect exposure to Y2K problems is broader than the numbers presented 
here. Survey figures only include fully electronic transactions. A number of business 
transactions occur which are electronic on one end but not on the other. An example 
might involve a small business owner placing a telephone order and the distributor 
processing it electronically. The primary implication is that the 75 percent noted 
earlier does not represent the full scope of indirect exposure of small business own- 
ers to Y2K. It must be amplified by partially electronic transactions which affect 
small business owners beyond those directly exposed and include practically every- 
one. 


3. AWARENESS OF THE Y2K PROBLEM 

Most small business owners claim to be aware of the Y2K problem. Fifty-three 
(53) percent say that they are “very aware” of it and another 28 percent say they 
are “somewhat aware.” Just 8 percent are “not very aware” and 10 percent are “not 
at all aware.” That means more than one million employers have limited or no 
awareness of Y2K. 

One hopes that those most at risk (and with the capacity to take corrective action) 
are the same people who are most aware of the problem. The correlation between 
the two proves high, but not perfect. Eighty-six (86) percent of small business own- 
ers exposed directly are aware of Y2K, 59 percent are “very aware.” Just 56 percent 
of those not exposed to direct risk are equally well aware. Thus, even if everyone 
is not aware, at least the overwhelming majority of the most vulnerable appear to 
be. 

Though considerable awareness of the Y2K problem exists among small business 
owners, comparatively few of those aware believe the problem is serious for their 
business. Just six percent of those aware term Y2K a “very serious” problem and 
23 percent of those aware call it “somewhat serious.” Most see Y2K as a rather 
minor affair with modest or non-existent consequences. One respondent used the 
phrase, “blown out of proportion.” In fact, 70 percent of aware small business own- 
ers term Y2K either “not very serious” or “not at all serious.” Incorporating those 
not aware of Y2K, the number of small employers who believe the looming problem 
is negligible or non-existent approximates 77 percent of the small employer popu- 
lation or about 4V2 million business. 

Awareness of the Y2K problem does not necessarily translate into alarm or even 
concern. Those who claim to be “very aware” are no more or less likely than are 
others to believe Y2K is a serious problem. Efforts to increase general awareness 
of Y2K, therefore, will probably have little impact on a small business owner’s level 
of concern over its impact. Instead, those wishing to stimulate action should shift 
the focus to the consequences for unprepared firms. 

4. ADDRESSING THE Y2K PROBLEM 

The number of owners who are taking action to address Y2K approximates the 
number who believe the problem is “very serious” or “somewhat serious.” Twenty- 
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three (23) percent of those who are aware of the problem report action taken or in 
progress. Another 27 percent say that they plan to take action before 2000, though 
they have yet to initiate any. If this latter group follows through on its plans, one- 
half of small business owners who are aware of the problem will have taken steps 
to address Y2K in advance. That figure represents 41 percent of the entire small 
business population. 

The relationship between the level of action and perceived severity of the problem 
suggests that perceptions change once action is taken. Exhibit 4 shows, as expected, 
that those who plan no action generally regard Y2K as “not at all serious” or “not 
very serious.” Again, as expected, those who plan action, but have not yet taken, 
any consider the problem more serious than do those not planning any. The inter- 
esting group, however, is the one whose members either have taken action or are 
in the process of doing so. Owners taking action should be the group who consider 
the Y2K problem most severe, and indeed it produces the greatest percentage (15 
percent) reporting the problem, “very serious.” But, Exhibit 6 shows that the most 
frequent response (34 percent) from this action-oriented group is “not at all serious.” 
One-third of those taking action think they have no Y2K problem to speak of. The 
remainder of responses among those taking action are distributed across the other 
possible answers. An explanation for this unexpected distribution is that action in- 
fluenced their assessments. Once they acted, some owners learned the Y2K problem 
was very serious for their firms while other found it inconsequential. If that opinion 
occurs among those who acted, one could argue that a similar division of opinion 
will arise among those who have not yet moved but are exposed. A likely result is 
that some who take no action will not even notice 9/9/99 or 1/1/00 while others will 
be very unhappy. 

EXHIBIT 5.— PERCEIVED SERIOUSNESS OE THE Y2K PROBEEM BY ACTION TO RESOEVE THE Y2K 

PROBLEM 


Problem seriousness 

Not at all Not very Somewhat Very 


Action level serious serious serious serious Total 

(percent) (percent) (percent) (percent) 


Not serious enough to worry about 70 25 3 2 100 

No aotion taken/planned 46 34 18 2 100 

Action planned 13 41 40 6 100 

Action taken 34 24 27 15 100 


Total 39 31 23 6 100 


4.1 Expenditures on Y2K 

The money spent by small employers taking action on the Y2K problem is com- 
paratively modest. Twenty-nine (29) percent have made no outlays to date and an- 
other 27 percent have spent less than $1,000. (“No outlays” might consist of an in- 
spection taken by in-house personnel.) TVelve (12) percent reported spending be- 
tween $1,000 and $4,999. Thus, over %’s of those taking action have expended less 
than $5,000. Another 13 percent don’t know how much they have invested. These 
sums do not necessarily represent the entire cost, however. Thirty-nine (39) percent 
report plans for future outlays, though these investments will be generally small as 
well. Their expected median value is about $2,000. 

The amounts spent on Y2K by owners taking action are notably less than their 
annual expenditures for computer equipment, software and maintenance. The an- 
nual median expenditure for these items is $7,500. Thus, much of their Y2K invest- 
ment appears to have been made part of routine maintenance and upgrades. 

Those planning action before the year 2000 intend to spend even less. Virtually 
none in this group (6 percent) have reported any expenditures to date. Their plans 
include 12 percent who anticipate spending nothing, 27 percent who plan to spend 
less than $1,000, and 20 percent who will spend between $1,000 and $4,999. One 
in three still doesn’t know how much they will spend, leaving just eight percent of 
this group planning expenditures of more than $5,000. That is about the median 
annual expenditure among the group for computers, software and maintenance. 

4.2 Plans to address Y2K 

Plans to address Y2K often appear fragmented. The group taking action exhibits 
somewhat more structure in its approach to Y2K than those still planning it. The 
most notable differences between the two groups occurs in the areas of budgeting 
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and verification of key vendor Y2K prevention steps. Small business owners taking 
action more frequently include a budget. Forty (40) percent of the action-oriented 
group have a budget for Y2K compared to 27 percent of the planning group. The 
planning group is more likely to check with key venders (49 percent compared to 
32 percent). However, a majority do not have either element as part of their plans. 
Infrequent budgeting might be explained by the relatively small expenditures as 
well as the possible use of monies previously budgeted for computer maintenance 
and upgrades. The failure to check with key vendors can only be attributed to over- 
sight or hesitancy to “interfere” in the internal affairs of another. Three of four from 
each group have designated a person to be in charge and somewhat fewer intend 
to test all changes made in response to Y2K. 

Small business owners are about evenly split among those who will tackle the 
problem in-house and those who will contract it out. The ones who have taken ac- 
tion tilt toward keeping the task in-house. It is logical that those with expertise 
within their firms would be more likely to address the problem before others. 

5. INFORMATION TO HELP SMALL BUSINESS OWNERS 

Over half (58 percent) of the small employers who are aware of the Y2K problem 
believe that they have adequate information concerning the problem, its potential 
impact on their business, and how to protect themselves from any adverse con- 
sequences. At the same time, 47 percent indicate that additional information would 
be helpful. 

Those most likely to feel that they have adequate information are found on both 
ends of the action continuum. Almost four of five (79 percent) owners who have 
taken action feel that additional information would not be helpful. Meanwhile, 62 
percent of the small employers who aren’t worried about Y2K feel the same. Those 
in the middle of the action continuum, particularly those planning action before 
2000, are most likely to believe that they need more information. 

Small employers say that the most helpful information would be a general de- 
scription of the problem and the difficulties it may cause as well as information on 
specific remedies for the most common ailments. Previously, it was noted that there 
was a general feeling that the problem lacks importance. Therefore, information de- 
scribing the problem needs to address consequences of inaction if it is to stimulate 
action. Few express interested in obtaining information containing the names and 
addresses of people or organizations that can help them resolve problems, or a de- 
tailed check-list of potential problem areas. 

6. CONCLUSION 

Virtually all save a healthy minority of the smallest, small businesses face direct 
exposure to a Y2K problem. Should their computer systems or other equipment/de- 
vices operated by a timing/dating mechanism malfunction, the consequences for 
about one in seven of those exposed are severe by the owners’ own assessment. 
Though more than 80 percent are aware of the Y2K problem including most of those 
with the most serious exposure, just 23 percent of them have taken action to deter- 
mine and correct the problem. Another 27 percent plan to do so prior to the year 
2000. Thus, half of those aware of Y2K currently appear ready to leave their fate 
to the forethought (or lack thereof) of computer programmers. 

The primary circumstance intervening between awareness of the Y2K problem 
and action appears to be the pervasive belief among small businessmen and women 
that Y2K is not a serious problem for their firms. Less than 30 percent believe the 
problem is “very” (6 percent) or “somewhat” (23 percent) serious. If the situation is 
not serious, the need to take action soon, if ever, is not a priority. Those attempting 
to help small business owners avoid Y2K problems, therefore, need to worry less 
about general awareness and focus on the likelihood and consequences of Y2K af- 
fecting their firms. 

The survey data cannot 3 deld an estimated Y2K impact for the small business 
population. Issues like the cost of substituting handwork for automation, average 
“downtime” during a malfunction, and the percent of firms exposed but not impacted 
are just three of the primary outstanding issues which are essential to the estimate 
and for which respondents could not provide reliable data. Still, the number of small 
businesses adversely impacted, if only modestly, will likely be very large. The sur- 
vey shows that 4% million small employers are directly exposed with additional 
owners indirectly (and often unknowingly) exposed as well. It also shows that only 
half of the those aware of Y2K have taken or plan to take action in response. Thus 
even if all of those planning to take action follow-through and another million 
(about one in five of the exposed population) eventually make plans and carry-out 
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preventive measures, over one million small, employing businesses will be directly 
exposed to the Y2K problem having taken no precautions. 

7. SURVEY METHODOLOGY 

The telephone survey on which this report is based was conducted during the lat- 
ter part of April, 1998, by The Gallup Organization. The Dun & Bradstreet file con- 
stituted the survey’s sampling frame. The sample itself was a stratified random de- 
sign. Half was drawn randomly from owners of small businesses employing between 
one and 9 people (n=250); the other half was drawn randomly from those employing 
between 10 and 99 employees (n=250). Sampling error for the population is -^.4 
percent. Unless otherwise noted, the data presented in the report are weighted to 
reflect the distribution of the entire small employer population. 


Year 2000 (Y2K) Problem 

(Survey Results) 

[Sponsored by Wells Fargo Bank, Conducted by The Gallup Organization in late April, 1998. Sample included 
small business owners emplo 5 dng from 1 to 99 people not including owners. n=500] 

1. How dependent is the operation of your business on the use of computers? 
Would you say that your business is very dependent, somewhat dependent, not de- 
pendent, or you don’t use computers in your business? 

Percent 


Very dependent 44 

Somewhat dependent 29 

Not dependent 5 

Don’t use computers 22 


Total 100 

n=500 


2. Do you have any equipment or devices in your business other than a computer 
that operate on an internal timing/dating mechanism or a micro-chip? Examples of 
such equipment might include automatic lighting and watering systems, elevators, 
scanning devices and card-readers. Do you have any? 

Percent 


Yes 34 

No 65 

Dont know 1 


Total 100 

n=500 


3. Do you sell, lease, or install as part of your business any devices that operate 
with an internal electronic timing/dating mechanism or a micro-chip? 


Percent 

Yes 11 

No 89 


Total 100 

n=500 

3a. What portion of your sales involve those kinds of devices? 

Percent 

All 10 

More than half 29 

About half 3 

Less than half 38 

Almost none 19 

N/A 1 


Total 100 


n=53 

4. How dependent is your business on automated processes? Would you say that 
your core business operation is very dependent, somewhat dependent, or not de- 
pendent? 
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Percent 


Very dependent 21 

Somewhat dependent 27 

Not dependent 49 

Not applicable 1 

Don’t know 2 


Total 100 

n=500 


5. If your computers, the devices operating on an internal timing/dating mecha- 
nism, automated processes, in your business were to malfunction, about what per- 
cent of your business sales or production would be lost for the period you were 
down? 


Percent Percent 

Percent 

Less than 1 40 

I- 10 14 

II- 20 5 

21-30 5 

31-40 3 

41-60 8 

51-60 1 

61-70 1 

71-80 5 

81-90 3 

91-100 7 

Don’t know/refused 3 

Not applicable 6 


Total 100 

n=408 

6. Does your business use its computers for . . .? 


Percent 

Billing and accounts receivable: 


Yes 74 

No 26 

Total 100 


Inventory control: 


Yes 41 

No 59 

Total 100 


Accounting and general ledger: 


Yes 76 

No 24 

Total 100 


Payroll: 

Yes 45 

No 55 


Total 100 


Administration, record-keeping, and word processing: 

Yes 84 

No 16 


Total 100 


E-mail and/or Internet access: 
Yes 


61 
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Percent 

No 39 


Total 100 


Maintaining customer and prospect lists and/or sales tracking: 

Yes 70 

No 30 


Total 100 


Design and product development: 

Yes 28 

No 72 


Total 100 


Operating machinery and/or equipment: 

Yes 20 

No 80 


Total 100 


Check reconciliation: 

Yes 51 

No 8 

Don’t Know 

Total 100 

n=386 

7. In a mix of custom and off-the-shelf software, would you say that your business 
uses all custom software, mainly custom software, 50/50 custom and off-the-shelf, 
mainly off-the-shelf, all off-the-shelf software? 

Percent 

All custom 10 

Mainly custom 7 

50/50 custom and off-the-shelf 22 

Mainly off-the-shelf 16 

All off-the-shelf 38 

Don’t Know 7 


Total 100 

n=385 

8. When was the last time your business updated its most critical software? Was 
it within the last 2 years, 2-5 years ago, 6-10 years ago, more than 10 years ago? 

Percent 

Within the last 2 years 81 

2-5 years ago 12 

6-10 years ago 2 

More than 10 years ago 1 

Don’t know 4 


Total 100 

n=385 

9. What does your business spend annually for computer equipment, software and 
maintenance? 

Percent 

Nothing 8 

$1 to less than $1,000 26 

$1,000 to $4,999 27 

$5,000 to $9,999 14 

$10,000 to $24,999 11 

$25,000 to $99,999 4 
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$100,000 or more 2 

Don’t know 7 


Total 100 

n=408 

10. How frequently do you interact electronically with your suppliers: a lot (fre- 
quently), a little (from time to time), not at all (never)? 

A lot (frequently) 18 

A little (from time to time) 36 

Not at all (never) 45 

Don’t know 1 


Total 100 

n=408 

10a. How critical is the use of computers to your SUPPLIERS’ operation? Is it 
critical, somewhat critical, not very critical, not at all critical? 

Percent 

Critical 30 

Somewhat critical 15 

Not very critical 18 

Not at all critical 28 

Don’t know 10 


Total 100 

n=408 

11. How frequently do you interact electronically with your primary financial in- 
stitution: a lot (frequently), a little (from time to time), not at all (never)? 

Percent 

A lot (frequently) 14 

A little (from time to time) 21 

Not at all (never) 64 

Don’t know 1 


Total 100 

n=408 

12. How frequently do you interact electronically with your customers: a lot (fre- 
quently), a little (from time to time), not at all (never)? 

A lot (frequently) 17 

A little (from time to time) 32 

Not at all (never) 51 

Don’t know 1 


Total 100 

n=408 

13. Are your sales PRIMARILY to private individuals or to other businesses and 
organizations? 

Percent 

Private individuals 52 

Businesses/organizations 40 

Don’t know 8 


Total 100 

n=408 

13a. How critical is the use of computers to your customers’ operations? Is it criti- 
cal, somewhat critical, not very critical, not at all critical? 

Percent 

Critical 40 
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Percent 


Somewhat critical 28 

Not very critical 10 

Not at all critical 11 

Don’t know 10 


Total 100 


n=164 

14. Are you aware of something called the “Year 2000 Problem,” often called the 
“Millennium Bug”? The problem involves a possible malfunction of some computer 
systems and similar devices on January 1, 2000. Would you say that you are very 
aware, somewhat aware, not very aware, or not at all aware with the year 2000 
problem? 

Percent 


Very aware 53 

Somewhat aware 28 

Not very aware 8 

Not at all aware 10 

Don’t know 1 


Total 100 

n=500 


15. How serious do you feel the Year 2000 Problem is for your business? Would 
you say that it is very serious, somewhat serious, not very serious, not at all seri- 
ous? 

Percent 


Very serious 6 

Somewhat serious 23 

Not very serious 31 

Not at all serious 39 

Don’t know 1 


Total 100 

n=405 


16. How do you intend to address the problem? Would you say it’s not serious 
enough to worry about, no action has been taken and none is now planned, you plan 
to take action before tbe year 2000 but haven’t yet, you have taken or are now tak- 
ing action to address the problem? 

Percent 


Not serious enough to worry about 22 

No action taken and none is planned 24 

Plan to take action, but haven’t yet 27 

Taken or are now taking action 23 

Don’t know 4 


Total 100 

n=405 


16a. (Are you/will you) initially (addressing/address) the problem on your own or 
(are you/will you) (bringing/bring) in someone from the outside to help? 

Percent 


In-house 47 

Contract out 42 

Don’t know 11 

Total 100 

n=202 


16b. Does your plan include . . . ? 

Percent 


A budget: 
Yes .. 
No ... 


33 

64 
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Percent 


Don’t know 3 


Total 100 


A designated person in charge: 

Yes 73 

No 26 

Don’t know 1 


Total 100 


Testing any changes you make: 

Yes 70 

No 24 

Don’t know 6 


Total 100 


Checking on your key vendors to he certain they don’t have a problem that 
affects you: 

Yes 41 

No 56 

Don’t know 3 


Total 100 

n=202 


17. How much money has your business already spent addressing the Year 2000 
problem? 

Percent 


Nothing 64 

$1 to less than $1,000 13 

$1,000 to $4,999 7 

$5,000 to $9,999 4 

$10,000 to $24,999 3 

$25,000 to $99,999 1 

$100,000 or more 0 

Don’t know 8 


Total 100 


n=202 

18. How much money does your business plan to spend, beyond what you have 
already spent, addressing the year 2000 Problem? 

Percent 


Nothing 25 

$1 to less than $1,000 21 

$1,000 to $4,999 17 

$5,000 to $9,999 5 

$10,000 to $24,999 2 

$25,000 to $99,999 2 

$100,000 or more 1 

Don’t know 29 


Total 100 


n=202 

19. How will your Year 2000 plans impact your sales? Do you think it will in- 
crease, decrease, or have no impact on them? 

Percent 


Increase 10 

Decrease 3 

No impact 84 

Don’t know 3 


Total 100 
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n=202 

20. How will your Year 2000 plans impact your employment level? Do you think 
it will increase the number of people working for you, decrease the number, or have 
no impact? 

Percent 

Increase 7 

Decrease 1 

No impact 90 

Don’t know 1 


Total 100 

n=202 

21. Have you verified that your suppliers and financial institutions are taking 
steps to prepare for the Year 2000? 

Percent 

Yes 32 

No 66 

Don’t Know 3 


Total 100 

n=405 

22. Have you verified that your customers are taking steps to prepare for the Year 
2000 ? 

Percent 

Yes 13 

No 83 

Don’t know 3 


Total 100 

n=405 

23. Do you believe that you have adequate information about the Year 2000 Prob- 
lem, its impact on your business, and how to protect yourself from any adverse im- 
pact? 

Percent 

Yes 58 

No 39 

Don’t know 4 


Total 100 

n=405 

24. Would you be very interested, somewhat interested, not very interested, not 
at all interested in learning more about the Year 2000 Problem and how it might 
affect your business? 

Percent 

Very interested 12 

Somewhat interested 35 

Not very interested 14 

Not at all interested 39 


Total 100 

n=405 

25. What type of information about the Year 2000 Problem would you find most 
helpful? 

Percent 

A general description of the problem and the difficulties it may cause 31 

Specific remedies for the most common possible problems 22 

How it would affect financial institutions (volunteered) 5 

Names and addresses of people or organizations that can locate or help re- 
solve possible problems in your business 4 

How it would affect my business (volunteered) 4 
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Percent 


A detailed check list of possible problem areas 3 

Other 6 

Don’t know 20 

Nothing 5 


Total 100 

n=247 


DEMOGRAPHIC PROFILE OF RESPONDENTS 

Dl. Which best describes the majority of your business activity? Do you make, 
construct, extract or grow something to sell; sell goods or products; sell services? 

Percent 


Make, construct, extract or grow something to sell 12 

Sell goods or products 29 

Sell services 56 

Don’t know 3 


Total 100 

n=500 


D2. Which BEST describes the area in which your business is located (main head- 
quarters)? Is it located in a city and surrounding suburbs with more than 500,000 
people, city and surrounding suburbs with 50,000 to 500,000 people, city of less than 
50,000 but more than 5,000, community of less than 5,000 or a rural area? 

Percent 


City and surrounding suburbs with more than 500,000 people 29 

City and surrounding suburbs with 50,000 to 500,000 people 28 

City of less than 50,000 but more than 5,000 20 

Community of less than 5,000 or a rural area 20 

Don’t know 1 


Total 100 

n=500 


D3. How many people do you employ? 


Weighted Unweighted 

(percent) (percent) 


1-4 57 35 

5-9 20 12 

10-24 14 28 

5-99 8 23 

Don't know 2 2 


Total 100 100 

n=500 


D4. During your last fiscal year, were your sales less than $250,000; $250,000 to 
less than $500,000; $500,000 to less than $1 million; $1 million to less than $2 mil- 
lion; $2 million to less than $5 million; $5 million to less than $10 million; $10 mil- 
lion or more? 

Percent 


Less than $250,000 42 

$250,000 to $499,999 18 

$500,000 to $999,999 10 

$1 million to $1,999,999 12 

i$2 million to $4,999,999 4 

$5 million to $9,999,999 3 

$10 million or more 2 

Don’t know 9 


Total 


100 
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n=500 

D5. How long have you owned or operated this business? 


Percent 

Less than 6 years 27 

6-10 years 23 

11-20 years 28 

21+ years 20 

Don’t know 1 


Total 100 

n=500 

D6. Please tell me your age? 

Percent 

Under 30 4 

30-39 18 

40-49 31 

50+ 45 

Don’t know 2 


Total 100 

n=500 

D7. Gender? 

Percent 

Male 74 

Female 26 


Total 100 


n=500 


Responses of William J. Dennis to Questions Submitted by 
Chairman Bennett 

Question. Mr. Dennis, I find your testimony is unnecessarily leaning to the opti- 
mistic side. The Wells-Fargo sponsored survey, which samples approximately 4.8 
million small employers, brings out these facts, and correct me if I’m wrong: 

— almost Vs of small employers reported that they would lose over 30 percent of 
their sales or production for the period their computers and automated proc- 
esses were down. That translates to well over 1 million small employers who 
are doing at best 70 percent of the business they were doing before Y2K prob- 
lems hit. 

Do you think it is appropriate to focus only on the extreme cases which is the 
330,000 or so businesses you refer to in your testimony? Wouldn’t most small em- 
ployers consider losing over 30 percent of sales or production significant? For in- 
stance, in this city, a large number of small vendors and eateries folded just due 
to the three week Government furlough in 1995. 

Answer. Your point is well-taken. Small businesses do not have to be completely 
shut-down in order to experience significant adverse impacts. This is particularly 
true if the loss of sales/production occurs over an extended period. In fact, the length 
of the loss may be more critical than the daily percentage of loss. For example, if 
a small business owner lost 100 percent of sales or production for a day, he would 
be unhappy. If he lost 30 percent for a month, he could be in serious trouble. Unfor- 
tunately, we could not ask a question on the survey about duration of downtime and 
expect an informed response. 

The report specifically notes that the difficulty with waiting until January 1, 
2000, to resolve a Y2K incident is that a small business owner probably will not 
be able to get anyone to fix the problem right away. Other customers, probably large 
businesses and governments, will have all the qualified locked-in. The small busi- 
ness will have to hobble along. When it finally does get someone in, the cost will 
be significantly higher than it would have been. The unknown length of downtime 
is, I believe, one of the strongest arguments for action. 

Your one-third calculation is not quite correct. That figure covers the population 
with direct exposure including those who have and have not taken action. Including 
only those who have taken no action and who do not plan any, the number directly 
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impacted is under one million. Still, that is a very large number, large enough to 
create considerable concern. 

Question. You state that over 80 percent of small employers are exposed to Y2K 
problems though their computers, but a majority of them plan no action as of the 
survey done in April of this year. You also say that "government isn’t particularly 
credible with small business owners nor are its communications." You do suggest 
working with trade associations to spread the Y2K message, but I’m wondering if 
this alone is sufficient. Can you provide the Senate with any suggestions that the 
Congress can take action on? 

Your written statement astutely points out that small employers have indirect ex- 
posure to Y2K problems as well as direct exposures, for instance with a customer 
or supplier whose computers the small employer must access. You estimate that this 
may extend to practically all small employers. Yet we learn from other parts of your 
statement that this group is particularly in the dark on the Y2K issue and is likely 
to remain so. This is very troubling. What can be done to get this very important 
part of our economy to pay more attention to this issue that may cripple them in 
just 450 days from now? 

Answer. The two most influential groups for small business owners are industry- 
specific trade associations and peers. Small businessmen and women are most likely 
to listen to and respond to these two groups. 

I have no doubt that the Committee could exert considerable influence on indus- 
try-specific associations through direct communication. The same would be true for 
local organizations whether as large as the Washington Board of Trade or neighbor- 
hood business organizations. This is no mean task. The Encyclopedia of Associations 
lists thousands of them. But I think it would be a useful endeavor. Further, small 
business owners will probably be more receptive to the message as January 1, 2000 
approaches. They usually face a myriad of business problems. Y2K is just one of 
them. So as the deadline nears, owners will be paying more attention. 

The second thing that you can do is to encourage larger firms and state and local 
governments to use their pulpits. They do business with millions of small firms. 
They could certainly provide a public service by doing as little as enclosing a letter 
about Y2K to their customers and suppliers. 

I would not expend my resources on media events or national campaigns in the 
traditional sense. Who has enough credibility and visibility to be taken seriously? 
Y2K is a business problem and political leaders lack credibility with Main Street 
on such matters. 

It is also important that the Committee or any other group make a credible case. 
As the survey shows, a large number of owners simply do not believe either that 
a problem exists or that the Y2K problem is serious enough to warrant attention. 
That means they need information clearly outlining the costs and consequences of 
not taking preventive action. For example, if I believe that I can replace an infected 
computer and software for $2,000 and that a consultant will cost $1,000 to tell me 
I have a problem, then why shouldn’t I adopt a wait and see attitude? That is a 
reasonable risk. But if you tell me, the problem will screw-up my records, perhaps 
irretrievably, and that I probably won’t be able to get anyone to come in and fix 
what I have left for a month, you have my attention. 

Though the data do not show it, I personally believe that a substantial number 
also simply don’t know where to begin. Many owners are not comfortable with the 
technology. To draw an analogy, they can drive it productively but don’t ask them 
what’s under the hood or how it can be fixed. 


Prepared Statement of Senator Christopher J. Dodd 

Thank you, Mr. Chairman, for holding this hearing. As you mentioned, this is the 
ninth hearing that this Committee has held. You have frequently compared your 
role in the Y2K issue to that of Paul Revere, but you. Senator Bennet, have logged 
far more hours than that legendary patriot. We know that the Y2K threat is coming. 
We know the time remaining between now and the turning of the millennium to 
the second. We know we must alert our citizenry. If the polls are correct, and if only 
a small percentage of Americans have heard of the year 2000 computer problem, 
then we have an extraordinary task at hand. 

This Committee has held eight hearings, covering such wide ranging subjects as 
electricity grids, health care, financial markets, telecommunications, emergency 
services, pensions and mutual funds, and now we come together to examine small 
and large businesses. 

Perhaps the single most important message coming out of these hearings is that 
the hour is late and the vast majority of the planet is not prepared. That the United 



68 


States leads the world in Y2K remediation is a thin silver lining when our hearings 
indicate that many sectors within the United States are not prepared, or just start- 
ing their Y2K planning. Just one of many areas that deeply concerns me is the 
small business sector. Many small businesses are either unaware or unconcerned 
about the Y2K problem. Yet they are crucial to the welfare of the American econ- 
omy. They employ nearly 18 million American workers. They provide 51 percent of 
the private sector output. Despite the label “small business,” they are by no means 
small in their importance. Whether they realize their role in our Y2K challenge is, 
unfortunately, another matter. Small businesses seem to think that they can hide 
from the Y2K problem. In a recent Wells Fargo Bank survey of small business Y2K 
preparedness, 81 percent of small businesses surveyed knew of the problem, but no 
more than 25 percent had acted on that information. This is unacceptable. 

I would like to borrow one of Senator Bennett’s metaphors which compares this 
committee to the National Weather Service. We have a worldwide Y2K storm brew- 
ing which, unlike the tropical storms and other disasters that the National Weather 
Service tracks, is at least partially controllable. We still have more than a year to 
identify the most critical systems and fix them. Unfortunately, we still lack the kind 
of international storm warning and response system that this issue requires. We 
need an international focus that can identify the global risk and take appropriate 
action to protect our interests in energy, food supplies, critical commodities and 
manufactured products. Until we see this kind of joint domestic and international 
participation, the Year 2000 technology problem will continue to pose a significant 
physical and financial risk to American and international citizens alike. 

Interconnectivity is another appropriate theme for this hearings. Almost all busi- 
ness sectors have some common Y2K factors such as computers, software and micro- 
processors. As we examine each industry in detail we are discovering that 
interconnectivity between businesses is one of the greatest issues we face. Most 
businesses are dependent on their suppliers, distributors, and customers through 
some means of electronic data interchange. The digital device that sends and re- 
ceives these messages is connected to some kind of computer or microprocessor that 
is run by software, any part of which may not be Y2K compliant. It only takes one 
part of the link to break for the exchange of data to come to an abrupt halt. Thus 
the hard work of many internally Y2K compliant companies could be for naught if 
their suppliers and distributors are not in synch with their respective Y2K remedi- 
ation efforts. We look forward to today’s witnesses discussing this issue with the 
committee. 

The Senate as well as the American public have a keen interest in monitoring the 
response levels that public and private organizations have displayed with respect to 
the Y2K problem. Most are aware of their civic duties, and have volunteered to tell 
the Y2K story, recognizing that their experiences will be useful to others. But there 
are other companies and industries that willfully and knowingly chose not to cooper- 
ate with our efforts. In many cases, these are companies whose products are essen- 
tial for the day-to-day existence of the average American. For example, many major 
representatives of the food industry have decided that it is not in their best interest 
to tell the public the Y2K status of their industry. Their industry associations were 
equally unsupportive. 

Based on the eight hearings that preceded this one, we have arrived at a fairly 
clear picture of our Y2K strengths and weaknesses. In general, all those affected 
with the Y2K bug have arrived at the party well beyond “fashionably late.” How- 
ever, today’s hearing provides us with one more opportunity to improve our response 
time for the ultimate deadline, the one just 450 days away. The pharmaceutical in- 
dustry will give us a complete picture of what it means when we talk about Y2K 
readiness. Their testimony highlights the extremely complicated and interconnected 
supply lines that provide millions of Americans with essential prescription drugs. 

The pharmaceutical industry includes a large international component. For exam- 
ple, diabetics can live long and healthy lives with the help of regular doses of insu- 
lin, a substance that is mainly produced in Denmark. If Denmark’s insulin produc- 
tion is affected by the Y2K bug or any other disaster, the thousands of Americans 
that depend on this drug to control their diabetes will find themselves in grave dan- 
ger. Insulin is just one product that embodies the interdependent nature of the 
world in terms of business and economics, as well as health and social welfare. We 
hope the Danes, and the rest of the international community are as concerned about 
Y2K as we are. Steps must be taken to insure that the factories that produce insu- 
lin, and other such life-saving drugs can function properly after January 1, 2000. 

The spectrum of American business centers around major producers, much as it 
has since the invention of commerce. If business history teaches us anything, its is 
the symbiotic relationship between large and small businesses. Large corporations 
need small companies to tailor the delivery of goods and services to meet consumer 
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needs. This morning we will see Y2K issues from both ends of the business spec- 
trum. Representatives of the 5 million small businesses, most with less than 500 
employees, have the unique challenge of meeting Y2K obligations which, in some 
cases, may be just as large as the ones facing companies with tens of thousands of 
employees. 

Again, thank you Mr. Chairman for your leadership, and thank you to our wit- 
nesses for their cooperation. 


Prepared Statement of Hon. Fred P. Hochberg 

Thank you, Mr. Chairman, for inviting the U. S. Small Business Administration 
(SBA) to testify before the Senate Special Committee on the Year 2000 Technology 
Problem. My name is Fred P. Hochberg, Deputy Administrator of the SBA, and I 
am here today on behalf of Administrator Alvarez, who joins me in welcoming the 
opportunity to discuss the so-called ‘Tear 2000” or “Y2K” problem facing the na- 
tion’s 23.6 million small businesses and their customers. We also look forward to 
providing information to the Committee on SBA’s efforts to improve awareness of 
this problem and to minimize its impact on small businesses. 

We at the SBA take the Year 2000 issue very seriously and the President has di- 
rected SBA to take a lead role in addressing this concern as it affects small busi- 
ness. The full extent to which the Year 2000 bug may affect businesses is unknown. 
However, it is clear that the damage can be minimized with foresight and prepara- 
tion. My testimony consists of two parts — what SBA is doing to insure that our own 
computer systems are Y2K compliant and what SBA is doing to help our customers 
understand the problem and have some information on how to address it in their 
own businesses. 


sba’s computer systems 

The SBA’s Year 2000 awareness efforts actually began in 1996 when we realized 
that, in order to better serve small businesses, we should improve our own internal 
computer protections. I am pleased to inform you that as of September 1998, we 
have completed the renovation of the computer programs in all of SBA’s mission 
critical systems. By the end of October we will have completed the validation and 
implementation of these programs — well ahead of targeted goals for the federal gov- 
ernment. Our non-mission critical systems also have been identified and, currently, 
we are working with our field offices to continue corrections of local systems in these 
offices. 

We are quite proud of the fact that the SBA was one of only three agencies to 
earn an “A” for our Y2K work when the House Committee on Government Reform 
and Oversight’s Subcommittee on Government Management, Information and Tech- 
nology issued its report card last month on the Federal Government’s progress in 
addressing the Y2K issue. 

Because we are ahead of schedule, we plan to conduct additional systems integra- 
tion and data exchange testing during the first quarter of fiscal year 1999. We will 
correct any identified problems by the end of the second quarter. 

To avoid taking anything for granted, we have established a Business Continuity 
and Contingency Planning Committee. I chair this committee and it is composed of 
the SBA’s top managers. Our goal is to ensure that SBA is prepared to deliver its 
services regardless of whatever problems we may encounter as a result of the Y2K 
issue. 


SBA IS SEEKING WAYS TO HELP OUR CUSTOMERS 

Once our internal improvement efforts were underway, we turned our efforts to- 
wards the private sector. We wanted to bring the seriousness of this problem to the 
attention of small business owners without creating undue panic. In addition, by 
educating small businesses that they could have a problem, we sought to prevent 
them from making any unnecessary expenditures toward fixing this problem. 

Initially, many people — including the SBA — believed users of new desktop hard- 
ware with off-the-shelf or “shrink-wrapped” software would be protected from the 
Year 2000 problem. SBA convened two separate industry review groups. The first 
consisted of the mainframe computer and independent software industries and the 
second represented desktop computer manufacturers and “shrink-wrapped” software 
producers. They helped correct our perceptions of the Y2K problem and gave us sug- 
gestions on how to present the problem to the small business community (Partici- 
pants listed in Attachment 1). These review groups were instrumental in helping 
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the SBA develop steps businesses can take to better prepare themselves to address 
the Y2K problem. 

The experts told us that even recently purchased equipment could be threatened 
by the Y2K problem. Validated systems may not actually be Year 2000-compliant 
if users have modified them by entering non-compliant data. 

In addition, there may be telecommunications problems associated with the fail- 
ure of microprocessors or “embedded chips” that are date-sensitive. This could affect 
credit card readers, automatic teller machines, feix machines, pager and e-mail serv- 
ice. Other items of concern to small businesses could be the possible chip-related 
failures of heating and ventilation systems, security alarms, and even elevators. 

YEAR 2000 AWARENESS PROGRAM MESSAGE 

As a result of our work with the industry experts, we developed the following ad- 
vice that anchors our Y2K outreach efforts. 

First, businesses are encouraged to conduct a self-assessment to see if they may 
have affected computer hardware and software, as well as any electronic equipment 
using date-sensitive embedxled computer chips. Operating systems, like DOS or Win- 
dows, should be evaluated for their vulnerability to the Year 2000 bug. Products like 
Lotus 1-2-3, Oracle, or Excel, which may contain date-reliant data, should also be 
reviewed. 

We are aware that it is not enough for small businesses just to take care of their 
own Y2K problems. They need to assure themselves that the companies in their 
supply and distribution network are also Y2K compliant. As we continue to revise 
and enhance our message to the small business community, we will encourage them 
to develop contingency plans for keeping their businesses operating. We believe this 
a very prudent action to take for ensuring business continuity in the event their 
normal suppliers or other supporting vendors are unable to provide the products 
and services they need. 

This is not just a computer problem, however, as other equipment with embedded 
computer chips could also be at risk. Anything that uses a calendar or date record 
should be assessed. Thorough assessment of elevators, machinery and other mecha- 
nized systems is key. The theme of this message is that it is not too soon to begin 
evaluating one’*s vulnerability to the Year 2000 threat. 

Second, businesses are encouraged to take action immediately. Corrective actions 
could range from a change in software to hiring a consultant to repair any problems. 
Repairs may not necessarily be expensive and we are encouraging businesses to con- 
tact their computer hardware and software vendors first. Fixing any Y2K problems 
discovered in the self-assessment is a must, and testing the repairs is vital. Upon 
completion of repairs, businesses must test and re-test to assure they won’t have 
any problems. Having a contingency plan is also necessary because businesses can 
never be sure if their vendors and other contacts are themselves compliant. 

Third, businesses are encouraged to stay informed about this issue. Accurate Y2K 
compliance information could change and business owners should keep abreast of 
any modifications they may need to make in their equipment or operations. A 
change in Year 2000 compliance by one business, regardless of size, could have a 
ripple effect for smaller businesses that rely upon its services or supply inventory. 
Visiting various Internet Y2K websites is a great way to stay current. 

These steps form the basic context of our public awareness program. We have pre- 
pared materials and media to notify small businesses about the Y2K issue. They in- 
clude posters, flyers, a fact sheet, a public service announcement (PSA) and phone 
hotline. Each of these provides basic information and refers people to the SBA 
website (www.sba.gov). The website features information on how businesses can pro- 
tect themselves from the Year 2000 problem (Attachment 2). The website also pro- 
vides “hyperlinks” to major computer hardware and software manufacturers and 
distributors to aid individuals in safeguarding their equipment and software from 
the Y2K Problem. Since its inception in February 1998, the site has been “hit,” or 
visited, over 840,000 times. 

Additionally, the SBA is making information available through a new toll-free 
phone number, 1-877-RUY2KOK. Started on June 23, 1998, the phone line is an 
automated “fax-back” system which allows callers to have Year 2000 information 
fcixed back to them at the conclusion of the call. 

YEAR 2000 AWARENESS PROGRAM OUTREACH 

Our coordinated national awareness program asks small businesses “Are You Y2K 
OK?” Our traditional resource partners, such as our lending partners, Small Busi- 
ness Development Centers, SCORE volunteers and small business trade associa- 
tions, in addition to our private sector supporters, have agreed to help spread our 
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message. For example the American Bankers Association included all of our mate- 
rials in their Year 2000 member resource guide. We look forward to working with 
the private sector to leverage our resources, experience and knowledge with the Y2K 
issue to help small businesses become compliant. Since our Year 2000 kick-off in 
early June, SBA’s efforts have resulted in numerous public forums with SBA rep- 
resentatives reaching a broad radio and TV audience. 

In addition, the SBA has conducted Y2K training events across the country. To- 
gether with IBM and the U.S. Chamber of Commerce, the SBA has developed a full- 
page advertisement on Y2K preparedness, to be published in Nation’s Business 
Magazine this month. As a result of the emphasis we have placed on this issue with 
our district offices, the SBA’s Y2K awareness campaign has been featured in more 
than 200 metropolitan and local newspapers since June. Administrator Alvarez was 
recently featured in a Y2K piece by Fortune magazine. 

Since June, we have distributed more than 2 million Y2K flyers through our pri- 
vate sector partners, such as financial institutions, power companies and news- 
papers. We are also very excited that we recently reached an agreement with the 
Internal Revenue Service to distribute nationwide, through their next mailing to 
small business owners, 6.5 million copies of our “Are You Y2K OK?” flyers. Requests 
for our “Are You Y2K OK?” materials, as well as for public service announcements 
and general Year 2000 information, continue to pour in. We are committed to meet- 
ing these requests and have plans to update our material later this year. 

The SBA continues to work hard to build alliances with trade and industry asso- 
ciations. We believe it is important to have as much help as possible in carrying 
our Year 2000 message. 


Y2K ACTION WEEK 

Before I conclude my testimony, let me tell you about an exciting activity we have 
planned for later this month. We will sponsor a nationwide initiative during the 
week of October 19th to focus government, business and media attention on the Y2K 
problem. During that week, we are asking all of SBA’s district offices and resource 
partners to sponsor at least one major Y2K awareness event. It is our hope that 
we can reach literally tens of thousands of small businesses during this week and 
motivate them to take action now on this serious management issue. 

We have received strong support from John Koskinen and his staff at the White 
House Y2K Office and will be joined in this effort by the Departments of Commerce, 
Agriculture, Interior, Transportation, the Social Security Administration, Internal 
Revenue Service and the U.S. Postal Service. Attendees at these events will then 
take the message back into their local communities. We hope that this issue will 
then be raised at local chambers of commerce and other business organization’s 
meetings to assist us in getting the work out to the small business community. 

CONCLUSION 

As we update both our material and our messages, we plan to continue encourag- 
ing small businesses to stay informed on this issue. Business owners can get up- 
to-date information by reading the newspapers, watching the nightly news, visiting 
the SBA website (www.sba.gov) and other websites and contacting their vendors. 
The best defense is staying informed and taking action accordingly. And most im- 
portant, everyone needs to take action now; it is too late to start early. We recognize 
that some businesses may be Year 2000 compliant already. However, the risks are 
too great not to check. Small business owners need to make informed decisions 
about this issue. 

The reaction to our efforts has been overwhelmingly positive. We both need and 
appreciate the support we’ve enjoyed from Congress as well as the businesses and 
trade groups who have allied themselves with our effort. As you return to your re- 
spective states in the coming weeks for town hall meetings and other public gather- 
ings, we urge you to carry forward the Year 2000 message. We are happy to provide 
materials or help you communicate with your small business constituents any way 
we can. The Year 2000 issue can be managed if businesses take responsible action 
now while there is still time. 

Thank you, Mr. Chairman, for inviting the SBA to testify. I look forward to work- 
ing with you. I will be happy to answer any questions. 

[ATTACHMENT 1] 

Participants in SBA Year 2000 Focus Group I, March 30, 1998 

Mr. John Koskinen, Assistant to the President, Chair, President’s Council on Y2K 
Conversion 
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Mr. Jim Morrison, Senior Analyst, National Association for the Self-Employed 
Ms. Heidi Hooper, Y2K Program Manager, Information Technology Association of 
America 

Mr. Anthony W. Powell, President, Anthony W. Powell, Inc. 

Mr. Alton Turner, Next Millennium Consultant. Inc. 

Mr. A. Nayab Siddiqui, President, Scientific Systems & Software International Cor- 
poration 

Mr. Jim Berish, Government Affairs, Hewlett Packard 
Dr. Kam F. Tse, Contemporary Technology, Inc. 

Mr. Andrew Pegalis, Next Millennium Consultant 

Mr. Scott Davies, Y2K Executive, Global Government Industry, IBM Corporation 
Mr. Bob Cohen, Vice President of Communications, Information Technology Associa- 
tion of America 

Mr. Bob Price, Corporate Y2K Manager, Digital Equipment Corporation 
Mr. Robert Wagman, Executive Editor, Millennium Information Service 
Mr. David Voight Director, Small Business Center, Chamber of Commerce 
Mr. Mike Roush, Small Business Technology Coalition 
Ms. Susan Tuttle, Program Manager, IBM 

Mr. David Y. Peyton, Director, Technology Policy, National Association of Manufac- 
turers 

Participants in SBA Year 2000 Focus Group II, April 23, 1998 

Ms. Moira Preixedes, Systems Analyst, Gateway 2000 

Ms. Lynn Silver, Senior Education Policy Manager, Apple Computer, Inc. 

Ms. Deborah Morse, Y2K Coordinator for Corel Products, Corel Corporation 
Mr. Dave Cunningham, Program Manager for Y2K, Dell Computer Corporation 
Ms. Beth Land, Corporate Strategist, Novell Corporation 
Mr. Rolin Hua, Vice President, Corporate Development SMAC Data Systems 
Mr. Ted Graig, Government Account Representative, Microsoft Corporation 
Mr. Roger Geides, Business Development Manager, Microsoft Corporation 
Mr. Scott Davies, Y2K Executive, Global Government Industry, IBM Corporation 
Mr. Mike Roush, Small Business Technology Coalition 

Ms. Heidi Hooper, Y2K Program Manager, Information Technology Association of 
America 

Ms. Nancy Peters, Information Technology Association of America 
Mr. David Voight, Director, Small Business Center, U. S. Chamber of Commerce 
Ms. Deborah Spencer, Technical Account Manager, Lotus Development Corporation 
Mr. Bernie McKay, Intuit Corporation 

[ATTACHMENT 2] 

The Year 2000 Problem 

ARE YOU READY TO DO BUSINESS IN THE YEAR 2000? 

If you think you are, have you completely tested all your systems to make sure 
you won’t have problems? Have you talked to your business suppliers and other 
business partners to ensure that they are ready? Whether or not you are ready, we 
invite you to reviewthis document on year 2000 readiness. 

WHAT IS THE YEAR 2000 PROBLEM * * * 

The year 2000 problem started decades ago when earlycomputers had very limited 
memory and storage space. Programmers saved space where they could by storing 
the absolute minimum amount of data necessary for business functions. One place 
they saved space was the date, in which years were represented by their last two 
digits. So, 1946 was represented and stored as 46, 1967 was stored as 67, and so 
forth. 

Reducing years to two digits works well as long as the century does not change. 
As the next century approaches, however, computers that still maintain years as 
two digits may not recognize that the year 2000 is greater than the previous year. 
Although a computer may recognize that 99 is greater than 98 (as in 1999 and 
1998), it may not recognize that 00 is greater than 99 (as in 2000 and 1999) and 
may consider it 1900. 

AND WHY IS IT SO IMPORTANT? 

Data processing systems used in all types of businesses rely heavily on dates and 
date processing. If the computer code does not recognize that one date is greater 
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than another, it may not be able toprocess properly and may produce erroneous re- 
sults. For example, if a loan is entered into a program with a start date of 1998 
and a payoff date of 2005 (98 and 05), the program may subtract 98 from 05 result- 
ing in a term of —93 years, rather than 7 years. This problem may put a business 
at risk because it could effect its cash flow, inventory, teixes, interest calculations, 
financial forecasting, customer relations, and many other areas. 

HOW BIG A PROBLEM? 

This worldwide problem not only affects mainframe computers and their pro- 
grams, but also personal computers and every piece of hardware that contains a 
microchip, including: 

— manufacturing control systems 
— telecommunications 

— money transfer and other financial systems 
— gas, water, and electrical utilities 
— stock markets 
— transportation 
— national defense 

— home computers, security systems, and appliances 

Beyond your own business computer systems, there is also the “business supply 
chain.” You buy goods and services from some businesses, and you sell goods and 
services to others. If your trading partners fail, your cash flow can suffer critically. 

In 1996, the Gartner Group estimated that the year 2000 problem would cost 
$600 billion to fix. Later estimates by Lloyds of London have been as high as $1 
trillion. Economist Ed Yardeni has estimated that there is a 35 percent chance of 
a global recession because some businesses will be unable to deal with their year 
2000 problems. And, unlike most projects, the final due date can not be changed 
with the year 2000 problem — the year 2000 will arrive whether we areready or not. 

NO “silver bullet” 

According to Peter de Jager, an internationally recognized expert in the year 2000 
problem, there is no single solution, no so-called “silver bullet.” Because each system 
processes dates in different ways, each system must be assessed and corrected. 

YOU can’t do nothing 

If you do nothing to fix this problem, your business may fail. Worse, because the 
year 2000 problem is a foreseeable problem, the officers and directors of your organi- 
zation could be held personally liable in shareholder suits. 

The Federal Reserve recognizes that small businesses are the backbone of the 
economy and wants to ensure your business’s continued good health. With estimates 
predicting that 1 percent to 7 percent of U.S. businesses will fail because of the year 
2000 problem, the Federal Reserve is encouraging all businesses to address the 
problem as early as possible. 


your business is at stake 

Imagine if you were unable to retrieve your accounts receivable records, or if one 
of your customers placed an order with you in late 1999 for delivery in early 2000, 
and that order was lost. Imagine if you could not correctly calculate the taxes or 
insurance premiums to be withheld for your employees, or if your inventory records 
were lost. 

The year 2000 problem may affect your business in countless ways. Your personal 
computers may reset themselves to the year 1980 or 1900 because the microchip 
that maintains the clock/calendar does notrecognize 2000 as a valid year. A photo- 
copier that records the count of the number of copies made in a day may stop work- 
ing in the year 2000 because the microchip may fail to recognize that “00” is a valid 
year. A security system may fail to operate properly and might allow unauthorized 
access to your buildings. A preprogrammed fax machine used to send announce- 
ments to your customers may stop working after 12/31/1999. A voice mail phone sys- 
tem may fail to record messages from customers or suppliers. A preprogrammed 
money transfer from a savings into a checking account to cover checks to your credi- 
tors may not take place. 

Reports of year 2000 problems are already surfacing in the media. In early August 
1997, the owners of a grocery store chain in Michigan sued the manufacturer of 
their cash registers because the terminals would not recognize credit or debit cards 
with an expiration date of 00. The owners claimed they had lost thousands of dollars 
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worth of business because the terminals rejected customers with valid debit/credit 
cards. 


it’s not just a data processing problem 

The year 2000 problem is a business problem. The decisions to spend the money, 
time, and resources are business decisions. The costs of making your organization 
compliant may be substantial, so the decisions on what to fix and what to risk not 
fixing need to be made at the highest levels. 

MANAGING TO YEAR 2000 READINESS 

Correcting the year 2000 problem in your organization will require senior man- 
agement involvement. The Board of Directors should be involved. You may want to 
form a year 2000 team, and include legal and audit representatives. If appropriate 
to your business, you may want to designate one person as your year 2000 project 
manager with responsibility for making your entire business ready for the century 
date change. You may also want to designate one person in eachfunctional area as 
a year 2000 coordinator or representative with responsibility for tracking that area’s 
readiness activities. Year 2000 readiness must be made a priority from the top 
down. 

An overall project plan with milestones and deadlines will be critical to your ef- 
forts. Each functional area should be encouraged to develop its own plans. 

Hint — project planning and tracking tool, such as Timeline® or Microsoft® 
Project, will help you track tasks that are due to start, past due, or are on the criti- 
cal path. 


Y2K STEPS TO TAKE 
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Y2K Checklists for Small Business 

No single Y2K checklist fits everyone’s needs since businesses have a wide variety 
of services and technologies. We are offering several that focus on small business 
needs, starting with the one below from the Federal Reserve Board. Links to addi- 
tional checklists, definitions, and resources are provided as well. This page is a 
“work in progress” and will grow as we come across more information. Keep in 
mind, there are many excellent checklists on the Internet. Browse the internet and 
if you find one you like, let us know! 
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SUGGESTED STEPS TO READINESS 

The most important first step is to develop a strategy to make your business 
ready for the year 2000. Many consulting firms have developed different strategies 
with 3 to 15 steps to take to help companies deal with the year 2000 problem. Infor- 
mation about these different plans can be found on the Internet or in trade journals. 

Here is a simple five-step plan to achieve year 2000 readiness. 

(1) Awareness — educating and involving all levels of your organization in solving the 

problem 

A crucial step in awareness is creating a communication strategy to make certain 
that everyone is informed and that management has the information it needs to 
make decisions. Holding seminars or meetings to educate people and bringing in 
outside speakers are two ways to increase awareness. 

A critical aspect of awareness is to develop an internal standard for year 2000 
readiness. The Federal Reserve uses the following definition: “Systems (e.g., soft- 
ware, hardware, firmware) are defined as ready if they can demonstrate correct 
management and manipulation of data involving dates, including single-century and 
multi-century formulas, without causing an abnormally ended scenario within the 
system or generating incorrect values involving such dates.” 

The awareness phase never ends. As people move to other jobs, and new people 
are hired, they must be educated. There is also an ongoing need to keep your staff 
and business partners informed. 

(2) Inventory — creating your checklist toward year 2000 readiness 

In this phase, you should identify and list all of the different computer-based sys- 
tems, components (such as in-house developed systems, purchased software, comput- 
ers and associated hardware), service providers, and hardware that contain 
microchips that support your business. Each entry on your list should be ranked by 
how critical it is to your business. 

Indicate on your inventory whether the component is hardware, software, or a 
service. It may be useful to note which components support your telephone or data 
communications networks. If a computer-based system uses a vendor-supplied pack- 
age, record the name of the vendor and the release number, if known. 

Hints — Keeping your inventory on a spreadsheet or database makes it easier to 
sort and report on items that are not ready. It is also helpful to develop an identi- 
fication system to help track components. For each item on the inventory, assign 
a person who will be responsible for assessing that item and preparing for the year 
2000. 

Reminder — Some systems will begin failing before the century date changes be- 
cause they perform forecasting or future processing. This is called “time horizon to 
failure” and should be considered during inventory and assessment. The “time hori- 
zon to failure” should be listed on your inventory if it is known. 

(3) Assessment — examining how severe and widespread the problem is in your busi- 

ness and what needs to be fixed 

Starting with the most critical items on the inventory, determine which systems 
are date-sensitive and if they will fail when the century changes. Systems with an 
imminent “time horizon to failure” should also be assessed first. A date-sensitive 
system is one that manipulates or works with dates in some way, or a system that 
operates differently based upon the date. Please refer to the questions later in this 
brochure to keep in mind when assessing your systems. 

Examples of date-sensitive systems include ones that perform any kind of fore- 
casting or projections through time, such as calculating interest on a loan or project- 
ing inventory levels. Other examples of date-sensitive systems are those which re- 
trieve records based on a date (such as invoices), or systems that sort items by date 
(such as accounting or inventory systems). Examples of date-sensitive hardware in- 
clude lighting systems that switch on automatically on weekdays, manufacturing 
control systems, and scanners or card readers that read ID badges or credit/debit 
cards. 

One way to assess a system is to look at the computer code and follow the logic. 
If this is not possible because the system is based on a purchased package, you 
should contact the vendor. 

Another way to assess a system is to run it as if it were already the year 2000. 
Running the system with dates other than the current date may require resetting 
the system date. There are risks involved in resetting system dates. Each organiza- 
tion should evaluate the impact of resetting system dates. This testing may require 
that your test data be “aged” properly so it contains the correct internal dates. 
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Hint — There are risks involved in rolling the dates on your computer systems for- 
ward. Make sure you understand what these risks are for your organization. 

For some specialized systems, such as building or manufacturing control systems, 
or systems with embedded microchips, you may need to have the vendor work with 
your staff to test and assess the system. 

Once you have determined the state of readiness for each system and component 
listed in your inventory, you should develop a strategy for dealing with those sys- 
tems that have to be fixed. There are only three possible strategies: repair, replace, 
or retire the system. 

If you decide to repair a system, there are two possible repair strategies or ap- 
proaches: windowing or date expansion. The date expansion strategy involves ex- 
panding all 2-digit year fields in your system’s data files and in the programs that 
process those files so they can hold the century as well as the 2-digit year. For ex- 
ample, a 2-digit year field YY might be expanded to a 4-digit CCYY field, where 
CC is the century. The date expansion may involve increasing the size of files that 
hold your data. 

The windowing approach involves inserting logic into your programs that inter- 
prets year fields to determine what century the year falls into before the date field 
is used in calculations, comparisons or sorting. An example of this logic: if the year 
is between 00 and 49, the century is 20, otherwise the century is 19. This is called 
the 50 year window. There are other windows. You need to determine which one 
is appropriate for your particular system. Whatever windowing logic is selected, we 
recommend consistency throughout your organization to avoid later errors and con- 
fusion. 

Most businesses are taking a mixed approach, fixing some systems using 
windowing logic and others with date expansion. Some are using such a mixed ap- 
proach to fix even large systems. Your choice depends on your own individual needs. 

If your strategy is to replace a non-ready system, you have several choices. You 
can build the replacement in-house (or hire contractors to work with your staff to 
build it), you can purchase a replacement system from a vendor, or you can 
outsource that particular line of business to a service bureau or other outside serv- 
ice provider. It is very important to determine when the replacement will be ready. 
If the replacement won’t be tested and installed until after the “time horizon to fail- 
ure,” you may be forced into a repair strategy. 

A business system that operates in isolation is very rare. Most interface with 
other business systems to exchange data, and some interface with systems outside 
your organization. Your strategy to replace or repair non-ready systems should take 
into account those systems’ interfaces with other systems, both within and outside 
your organization. For example, if you opt for date expansion, you must consider the 
impact of sending larger files to all interfaces. If you opt for windowing, all inter- 
faces must be informed what the windowing scheme is. 

Hint — We recommend that you develop a chart that shows the systems that have 
interfaces, what those interfaces are, and when they occur. 

Different systems that interface with each other may have different schedules for 
assessment, correction, and implementation. It may be necessary to build “bridges” 
between systems that are ready for the year 2000 and those that are not. These 
bridges, which are usually temporary programs, take data from one system and 
modify it to make the format correct for the interfacing system. Careful, detailed 
planning will be required to handle these situations. 

When you find that a system is not year 2000 ready, determine how critical that 
system is to your business. For example, if the system prints an invalid date on an 
internally used report, you may decide that this problem is not significant enough 
to address. If, however, the system loses track of inventory data or fails to forecast 
properly, it should be fixed. 

Hint — ^As you purchase new computers, packages, and other hardware, upgrade 
existing packages, and develop new lines of business, remember that this new 
equipment needs to be checked to ensure it is year 2000 ready. Upgraded packages 
also need to be checked for readiness after upgrading. 

(4) Correction and Testing — implementing the readiness strategy you have chosen 
and testing the fix 

Testing is a critical aspect of any year 2000 project. Testing verifies that the re- 
paired or replaced system operates properly when the date changes and that exist- 
ing business functions (such as accounting, inventory control, and order tracking) 
continue to operate as expected. Testing also verifies that interfacing systems are 
not adversely affected. You should not confine your testing efforts solely to computer 
programs. Other systems (including network operating systems, vendor-supplied 
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software, building infrastructure systems, PCs, and components with embedded 
microchips) should be tested to ensure they will not fail when the century changes. 

There are several critical tests you should perform once you’ve changed or re- 
placed a system. The best way to see if a system is ready for the year 2000 is to 
test the system as if it were already the year 2000. Test that the system will operate 
correctly after the date has rolled over from 12/31/1999 to 1/1/2000. Because the 
year 2000 is a leap year, you should test that your system will recognize 2/29/2000 
as a valid date and that it will roll over from 2/28/2000 to 2/29/2000, and from 2/ 
29/2000 to 3/1/2000. You should also test your fixed system with a date before 2000 
to insure that it works. See the attachment for other suggested dates to test on your 
system. 

Warning — There are risks involved in rolling dates forward on computers. Some 
computer security systems keep track of the last time a user accessed a system and 
will revoke or inactivate that user’s password if it has not accessed the system for 
a period of time. Rolling the date forward may cause user passwords to be inac- 
tivated by the security system. 

Datasets that should be retained may be marked as expired and could be written 
over. Some software packages may be leased and you may be paying an annual fee 
to the vendor. Rolling the date past the end of the lease may cause the software 
package to freeze up or generate error messages. 

There are several other tests that you may want to carry out, depending on the 
functions your system supports. If your system does end-of-week, end-of- month, end- 
of-quarter and/or end-of-year processing, these should be tested. You should test 
that the system will forecast and retrieve data properly. Set the date to a date in 
1999 and check that the system will forecast into the next century. Set the system 
to a date in the 21st century (any date after 12/31/1999) and test that the system 
will retrieve historical data from some period before 12/31/1999. 

Hint — Whenever possible, testing should be carried out in a test environment to 
minimize the chance of corrupting the production systems. Also, be careful changing 
historical or backup files if you choose date expansion. You may lose an important 
audit trail. We suggest you consult with your auditors and legal staff before chang- 
ing historical or backup files. 

Definition — The term “production environment” refers to the set of hardware and 
software that supports your day-hy-day operations. “Test environment” refers to the 
hardware and software where new or changed systems can be tested without dis- 
turbing your day-to-day operations. 

Hint — Testing of changed systems should be carried out in an environment that 
is ready for the year 2000. You should work with your vendors to determine when 
their hardware platforms will be compliant and use those dates to build your test 
plans. If your vendor cannot supply the platform in time to meet your schedule, you 
should be aware of the risks involved and be prepared to retest your changed sys- 
tems once the platform is ready. 

(5) Implementation — moving your repaired or replaced system into your production 
environment 

Before you install your replacement or repaired system, you should develop an in- 
stallation plan and contingency plans. The installation plan lists all the files and 
programs that need to be moved into production, and all the steps to make your 
changed system work. Your installation plan may include testing in production to 
insure that the installed systems are working as expected. Contingency plans list 
the possible problems that you can foresee and what steps you will take if these 
problems occur. 

Hint — ^You may want to make backups of the production files from the old system. 
If possible, you may want to install the ready system and run it in parallel with 
the old system and compare results. 

Reminder — Your contingency plans should not include reverting to the old system. 
The old system is not ready for the year 2000, otherwise you would not be replacing 
or repairing it. 

Warning — In planning to replace a system, make certain that you allow enough 
time to replace all of the necessary pieces of that system. 

don’t get contaminated 

Once you have repaired your systems and made them year 2000 compliant, you 
should take steps to make sure that subsequent changes do not contaminate those 
systems with year 2000 bugs. A system might get contaminated if a programmer 
makes changes to a repaired system and inadvertently changes the logic that han- 
dles the century change. A vendor-supplied package might also become contami- 
nated if subsequent releases of the package don’t include the year 2000 changes. 
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Retest the year 2000 changes as part of any subsequent system modification ef- 
fort. We recommend that you save the test data and test cases that were used to 
test the original changes and use them whenever you are testing other changes to 
that system. This is called regression testing. We also suggest that any new releases 
of vendor-supplied packages also be year 2000 tested. 

PERSONAL COMPUTERS 

Today personal computers are widely used in many businesses. All personal com- 
puters have an internal clock/calendar that maintains and reports the date and 
time. In some computers, the year is stored and processed as two rather than four 
digits. The year 2000 will affect these computers just as it affects other systems. 
If you are running systems on your computers that access that PC’s date, these sys- 
tems may fail or produce bad results. All PCs should be tested, regardless of how 
they are used. 

An insert in this brochure lists the steps you can follow to test your personal com- 
puter. You can also run PC test software that is available on the Internet. 

Take an organized approach to this problem. List all your PC’s, test them for 
readiness, and mark those that are not ready for later attention. Bright fluorescent 
labels can be used to mark PCs as ready or not. 

There are several possible ways to correct this PC date problem. You may contact 
a computer retailer to investigate purchasing a new Basic Input/Output System 
(BIOS) chip that is year 2000 ready, download software solutions from the Internet, 
or replace the non-ready PC with a model that is. 

Hint — ^Anytime you reset the date on a PC, you run the risk of corrupting your 
system. You can minimize that risk either by backing up all of the critical files or 
by resetting the date in a test environment. Don’t forget to reset the date to the 
correct date/time after you have tested the system. If you are testing a LAN file 
server, power off all of the workstations connected to that LAN before going through 
the date test procedure. 

Warning — Even a brand-new state-of-the-art PC may not be ready for the year 
2000. New PC’s should be tested before they are installed. 

YOUR BUSINESS IS NOT ALONE 

No business exists in a vacuum. Yours is part of a chain of customers, suppliers, 
utilities, and vendors. Year 2000 failures in any of these can impact your business. 
Here are some tips to protect your business within this chain. 

Vendor-supplied products — Many software vendors were caught by surprise by the 
year 2000 problem and some will not be able to make their products ready. Others 
may make their products ready but may not be able to deliver the ready software 
until late 1999. Some vendors may no longer support a particular product that you 
may be running, and other vendors may have gone out of business. 

For date-sensitive systems, contact the vendors to find out their readiness plans. 
If a vendor will not give you information about the readiness status of a package, 
or if a ready version will not be available until late in 1999, you should investigate 
an alternate system. Even if a vendor insists its product can handle the century 
date change, you still should test and certify it to your satisfaction. If the vendor 
insists that an upgraded version of a program package is ready, that package still 
must be tested since the vendor may have a different definition of readiness. 

Data processing service bureaus — If you use a service bureau for your data proc- 
essing needs, contact it to discuss its plans for year 2000 readiness. 

Make a list of all the services provided by your service bureau, ranking them ac- 
cording to how critical they are to your business, and then contact the service bu- 
reau in writing about each service. If a service bureau says it is ready for the year 
2000, ask it to provide test results demonstrating this, if possible, test the service 
for yourself. If it is ready for certain services but not for others, you should deter- 
mine what this means to your business. Decide if there is a “work around” you can 
implement. If the service bureau says it will have a year 2000 version in the future, 
you need to assess what that means to your business. A date late in 1999 may be 
too risky. 

Utilities and services — If your local utility fails to provide you with water, gas, 
or electricity, your buildings will not be usable and your business will suffer. You 
should also contact other companies that provide essential services such as jani- 
torial, repair, delivery, etc. You should contact all of your suppliers to discuss the 
state of their year 2000 readiness and make contingency plans. 

Record storage/retention firms — You may use such a firm to store critical legal 
documents and backup tapes offsite. These firms should be contacted to determine 
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their state of readiness. It could be disastrous if you have an emergency and dis- 
cover that your offsite storage firm can’t find your backups. 

OTHER SOURCES OF HELP 

There are many helpful sources you can turn to for making your business ready 
for the century date change. The Internet has thousands of web sites dedicated to 
the year 2000 problem. Many sites have links to sources of freeware, planning tools, 
discussion groups, and so forth. 

Here is a short list of useful Web sites. 

http://www.year2000.com — Peter de Jager’s Web site — a good source of links to 
other sites 

http://www.compinfo.co.uk/y2k/manufpos.htm — contains links to computer manu- 
facturer’s home pages where you can find Year 2000 compliance information 
http://www.software.ibm.eom/year2000/ — IBM’s Year 2000 page 
http://www.microsoft.eom/smallbiz/edge/yr2000/default.htm — Microsoft’s Year 2000 
page 

http://www.gmt-2000.eom/gmt-2000/homepage — frameset.html — the link to 

Greenwich Mean Time’s home page with evaluations of PC testers and BIOS 
chips — useful for PC evaluation 

http://pw2.netcom.eom/helliott/00.htm — The so-called “Mother of all Y2K link 
sites” contains many links to other sites 

http://www.jks.co.uk/y2ki/confer/notices/dtisme01.htm — link to a report “Helping 
the Small Business Tackle Year 2000” 
http://www.isquare.com/y2k.htm — The Small Business Advisor Web site 
http://www.bog.frb.fed.us/y2k/ — The Year 2000 page of the Board of Governors of 
the Federal Reserve Bank 

http://www.ffiec.gov/y2k/ — The Year 2000 page of the Federal Financial Institu- 
tions Examination Council 

http://www.frbsf.org/fiservices/cdc — The Federal Reserve Bank of San Francisco’s 
year 2000 page 

Professional organizations or trade associations may be able to provide you with 
support and advice. There are many consulting firms and independent consultants 
who can help you get your business ready for the century date change. Many data 
processing and business magazines have articles about the year 2000 problem and 
most large cities now have year 2000 user groups that meet to discuss the problem. 
One magazine that is dedicated solely to the year 2000 problem is called The Year 
2000 Journal. The Journal can be reached at (214)-340-2147; its Internet address 
is http://www.y2kjournal.com. 

If you can’t find a year 2000 user group in your area, form one. It can become 
your support group and someone in your group may have already solved problems 
that you are facing. If you form, or join, a year 2000 user group, invite local political 
officials to become involved. They will have to work with their local government 
agencies to ensure that police and fire services, water, electricity, and other utilities 
are uninterrupted. 

SOME QUESTIONS TO HELP ASSESS SYSTEM READINESS 

1. Can the system perform projections through time? For example, can it calculate 
interest or payments or make inventory projections? 

2. Does the system allow for entering dates? If yes, is the year 2 or 4 digits? What 
happens if you enter “00” or “01?” 

3. Will the system operate differently depending on the day of the week? Will it 
operate differently at month-end, quarter-end, or year-end? 

4. Can the system put things in order by date? 

5. Does the system allow you to retrieve things by date? 

6. Can the system perform date-based calculations? 

7. Does the system have a security feature that includes date checking? 

SUGGESTED TESTING CRITERIA 

The following list is not all inclusive. You should add others based on your 
business’s needs and ignore those that are not appropriate. 

1. Test the changed system with dates before the year 2000 to insure that it is 
working properly. 

2. Test that the changed system rolls over from 12/31/1999 to 1/1/2000 properly. 

3. Validate the first business day of the year 2000 (1/1/2000, 1/2/2000 or 1/3/2000 
depending on your business needs). 
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4. Validate that the system operates correctly at end-of-month (1/31/2000 and will 
roll over to 2/1/2000 properly. 

5. Test that the system rolls over from 2/28/2000 to 2/29/2000 properly, operates 
correctly on 2/29/2000, then rolls over and operates properly on 3/1/2000. 

6. Test 3/31/2000 and 4/1/2000 to show that end-of-quarter processing operates 
correctly. 

7. Test 1/7/2000 and 1/10/2000 to insure that the system operates correctly on the 
first Friday of the new century, and on the Monday after the first Friday. 

8. Validate year display fields, including data entry. 

9. Validate the year in reports. 

10. Test that the system sorts in correct order, validate all sort processing. 

11. Validate correct calculation of dates. 

12. Validate the correct acceptance of dates from the operating systems. 

13. Validate calculated resultant values from dates. 

14. Test that ages are calculated correctly. 

15. Validate interest and other time-hased financial calculations. 

16. Test expiration date processing. 

17. Test historical decision analysis. 

18. Validate time reporting processing. 

19. Test workflow/materials requisition and inventory processing. 

20. Verify that hilling calculations are correct. 

21. Validate cycle processing, including day-of-week and/or first business day of 
the month. 

22. Verify that the system forecasts correctly. 

23. Test forward processing — process dates after the year 2000 (2001, 2002, &c.). 

24. Validate backward processing — process dates prior to 2000. 

25. Verify historical or archival date processing. 

26. Validate that the system purges the correct records. 

27. Validate date and data error handling routines. 

28. Validate date expansion, if used, both within the application and between 
interfacing applications. 

29. Validate windowing, if used, both within the system and between interfacing 
syst0rn.s 

30. Validate proper handling of special values in dates — 99/99/9999, 88/88/8888, 

00/00/000. 

31. Validate that the system works with the date 1/1/1999 — first date with “99” 
in the year field. 

32. Validate that there are 366 days in the year 2000, and 365 days in the year 

2001. 

33. Validate that 9/9/99 (September 9th, 1999) is handled properly. 

Some additional dates that may impact businesses. 

1. 7/1/1999 — 46 out of 50 states start their fiscal year 2000. 

2. 10/1/1999 — start of Federal Government’s fiscal year 2000. 

3. 2/15/2000— W2 due. 

4. 4/15/2000 — Tax day. 

5. 4/30/2000 — first month ending on a weekend. 

6. 5/1/2000 — tax withholding report due, unemployment tax due. 

7. 9/30/2000 — Federal Government’s end of fiscal year 2000. 

8. 10/10/2000 — first “6-digit” date for systems storing date as MDDYY. 

9. 12/31/2000 (Sunday) — ^first year end — check that year contains 366 days. 

10. 1/1/2001 — test that the system has been instructed to roll over to 2001. 

11. 2/29/2001 — invalid date. 

12. 12/31/2001 — second year end — check that year had 365 days. 

HOW TO CHECK A PERSONAL COMPUTER FOR YEAR 2000 READINESS 

The following steps are suggested to determine if a personal computer will roll 
over to the year 2000 correctly. 

The test presented here requires a bootable DOS floppy diskette. This is a safer 
method to test your PC’s system clock because it leaves the data and programs on 
your PC’s hard disk unaffected. If you boot to your C: drive, you may end up loading 
Windows or Windows 95 and other applications from your startup routine. Using 
a bootable diskette will ensure the integrity of the data and programs on your PC’s 
hard disks. The test script presented here will check your PC’s ability to transition 
to the year 2000 and recognize it as a leap year. 

Do not perform the tests by changing your system’s BIOS Setup screen. 
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Create a bootable test diskette. Insert a blank floppy diskette into the PC’s A: 
drive. From a DOS prompt, type FORMAT A: /S. Or from Windows File Manager, 
click on DISK/FORMAT and check MAKE SYSTEM DISK. 

With the bootable diskette created in Step 1 still in your PC’s floppy drive, shut 
down your system (close Windows) and the power off your PC. Don’t just hit the 
reset button or warmboot (CTL-ALT-DEL). 

Turn the power on your PC, and allow the PC to boot from the diskette. 

After bootup, DOS automatically shows the current date. Make sure that the cor- 
rect date is displayed. Otherwise, you may have to set the correct date on your PC’s 
BIOS. 

At the Enter new date (mm-dd-yy) prompt, type 12-31-1999. 

After changing the date, the current time will be displayed. 

At the Enter new time: prompt, type 23:55:00. 

Turn the power off on your PC and wait at least 10 minutes. If you don’t, DOS 
will appear to transition correctly to the year 2000. However, once you reboot the 
PC, it will display the incorrect date if your system’s RTC has the flaw described 
above. 

Turn the power back on and wait for the boot process to complete. 

Type in Date at the ready prompt. If Sat 01-01-2000 is displayed, your PC’s 
BIOS passes the test. 

At the Enter new date (mm-dd-yy): prompt, type 02-28-2000. 

This will test your system’s ability to recognize the year 2000 as a leap year. 

After changing the date, the current time will be displayed. 

At the Enter new time: prompt, type 23:55:00. 

Power off your PC again and wait at least 10 minutes. 

Turn the power on the PC. Type in Date at the Ready prompt. 

If Tue 02-29-2000 is displayed, your PC’s BIOS passes the leap year test. 

To conclude testing, at the Enter new date (mm-dd-yy): prompt, enter the correct 
date, e.g., 07-04-1997. 

After changing the date, the current time will be displayed. At the Enter new 
time: prompt, type correct time, e.g., 06:00:00. 

Remove the bootable diskette from the floppy and power off your PC. 


Responses of Fred P. Hochberg to Questions Submitted by 
Chairman Bennett 

Question 1. I understand that SBA will be guaranteeing 50 percent of the loan 
value up to $50,000 to help small businesses pay for Y2K fixes. Can you character- 
ize or project how quickly the guaranteed funding will enable small businesses to 
complete remediation and testing efforts? For example, if a typical small business 
were to obtain funding and begin remediation efforts in December of 1998, what are 
the chances they could reach compliance by the year 2000? 

Answer. The legislation (H.R. 3412) establishing a targeted Y2K pilot loan pro- 
gram at SBA failed to pass before Congress adjourned. However, SBA believes its 
current loan programs are already structured to do the type of Y2K mitigation loans 
envisioned in this legislation. SBA recently changed its SBAEXPRESS and LowDoc 
programs to expedite and simplify the delivery of funds to small businesses. These 
programs are specifically designed for the type of loans that businesses would need 
to address Y2K in an expedited manner. For example, under our SBAEXPRESS pro- 
gram, small businesses can receive a loan to address Y2K-related problems for up 
to $150,000 with a guaranteed turnaround time of 36 hours or less. 

With regard to the second question, the time required for Y2K remediation efforts 
will vary from one small business to the next depending upon the complexity of the 
Y2K issues at each small business. If the fix happens to be solely reprogramming 
the internal clock of a personal computer, then obviously the fix can be done quick- 
ly, often within one day. If the fix involves a complete overhaul of entire systems, 
including procuring new machines, then the fix will be more complex and may take 
an 3 rwhere from a week to many months. If the fix is reviewing computer programs, 
on a line-by-line basis involving millions of line of computer code, the fix may be 
especially long and may be dependent upon finding capable technical staff to com- 
plete the work. In this latter case, this work will require many months. Our mes- 
sage to all small businesses is to take action now, don’t delay. To assist small busi- 
nesses in getting quick access to the information they need, SBA’s Y2K website 
(www.sba.gov/y2k) we have include direct links to over sixty computer hardware 
and software manufacturers. 

Question 2. What sort of figures or data can SBA provide about the potential im- 
pact of small business failure on the supply chain? For example, if it is expected 
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that 50 percent of all business experience a failure of a mission critical system, does 
SB A have any projections as to how this could impact the economy in either the 
short term or long term? 

Answer. The SBA does not have any data regarding the impact on the economy 
in either the short term or long term as a result of the Y2K issue and possible small 
business failures. However, we do believe that the Y2K issue is a management 
issue, not a technical issue. As such, small businesses who exercise prudent man- 
agement judgement in their everyday operations will successfully solve their Y2K 
issues in a timely fashion. Those small businesses that are unable to address ongo- 
ing management challenges will also have a difficult time in addressing the Y2K 
issue. In other words, I believe few small businesses will fail solely because of the 
Y2K issue. A small business with poor management skills is likely to fail because 
Y2K is just one of many issues they have not been able to overcome. Accordingly, 
the success/failure rate of small businesses will not be radically affected and the 
overall effect on the economy will be minimal. 

Question 3. What is the greatest concern SBA has for small businesses? 

Answer. Our greatest concern is that small businesses are not taking action soon 
enough on this important issue. Small businesses tend to focus on the “here and 
now” as they grapple with business management issues every day. January 2000 
is over a year a way and that is an eternity for most small businesses. The longer 
a small firm waits, the more costly the Y2K “fix” will be. Our slogan is “Its too late 
to start early.” 

Question 4. How is the SBA stressing the importance of business continuity plan- 
ning? Have you identified best practices for business continuity planning? 

Answer. SBA has identified best practices and developed materials, classes, semi- 
nars, speeches and a web site stressing the importance of contingency planning as 
part of an overall Y2K strategy for every small business. On our web site, 
www.sba.gov/Y2K, we offer advice on contingency planning. Specifically, we offer in- 
formation on contingency planning in our seminar materials. These materials, devel- 
oped by IBM for our use during our national Y2K Action Week, provide an excellent 
guide for small businesses as they address their Y2K issues. 

Question 5. Does SBA have any estimates as to the overall cost of Y2K for small 
business? 

Answer. We have not conducted any independent studies of the overall cost for 
small businesses. However, we are in contact with the National Federation of Inde- 
pendent Businesses (NFIB) and its Y2K staff. NFIB issued a study this past May 
on the preparedness of the small business community for the Y2K problem. It is 
conducting a follow-up study, which should be available by the end of this year, and 
has offered us the opportunity to review the data they receive. We expect the study 
to address this issue and give us insight on the overall cost. 

Question 6. Does SBA have any figures indicating the reliance of small business 
on information technology? For example, do you know what percentage of small 
start-up businesses rely heavily on computers. 

Answer. SBA has not done any research in this area and does not have any data 
readily available to make an estimate regarding the percentage of small start-up 
businesses that rely heavily on computers. In addition, we are not aware of any 
similar studies having been done in the private sector. 


[United States Small Business Administration — Small Business Research Summary — RS Number 156 
(November 1995) ISSN 1076-8904] 

The Effect of Computer Use on the Earnings of Workers by Firm Size 

[By Rakesh Kochhar, 1994, 104p. Completed by Joel Popkin and Co., 1101 Vermont Ave.N.W., Washington, DC 
20005, under contract no. SBA-8033-OA-93] 

PURPOSE 

The use of computers by workers is an important element in the currentt employ- 
ment shift toward higher-skill jobs. The extent of smalll businesses’ participation in 
this shift, and the wage benefitss by firm size to employees participating in the 
shift, are thee subjects of investigation in this study. 

Many policy-makers believe that the competitive potential of U.S.businesses — both 
at home and abroad — will depend on the ability off firms to incorporate computer- 
based technologies and to upgrade thee skills of their workers. It is important to 
understand how smalll and large firms have adapted their work places to the 
emergingg information-based economy and whether they have realized similarr 
gains in productivity from the use of computers. Productivity gains from the use of 
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computers is expected to be bestt measured by the wage differential of computer 
users over otherr workers in the same industry. 

SCOPE AND METHODOLOGY 

Data for this research became available with the inclusion of a question on com- 
puter use in the Current Population Survey (CPS) of January 1991. These data were 
merged with data on firm size from thee March 1991 survey and wage data from 
the April 1991 survey. The CPS is a regular survey of households by the Bureau of 
the Census and covers over 50,000 households. The survey panel changes fromm 
month to month, so only those households included in the surveyy in all three peri- 
ods could be used. The result was 28,407 observations that matched across all three 
time periods, or less thann half of the 67,374 individuals reporting on employment 
in January 1991. Workers under the age of 16 and over the age of 66 were elimi- 
nated from the sample, as well as a few workers with very low wages. The final 
sample was 18,009 individuals. The data permitted further analysis by worker age, 
education, sexjob tenure, industry, and occupation. The analysis revealed the wage 
returns to computer usage to be robust and nearly constant acrosss firm sizes, in- 
dustries, and all of the above worker characteristics. Computer usage in informa- 
tion-based industries was the highest; production occupations showed the lowest 
computer usage by workers. Growth industries were analyzed separately and 
revealedd higher computer usage among workers in growing industries. 

HIGHLIGHTS 

— Small firms were found to be hiring college-educated workers and creating jobs 
at the top end of the wage spectrum in greater proportionss than in the past. 
Among new hires, small firms employed 58.9 percent of all workers and 64.8 
percent of new hires in the top wage quartile. In the time period covered in the 
report, small firms were responsible for the majority of new hiring at the high 
end of the wage spectrum. The author states, “Between 1990 and 1991 most 
high-wage jobs were being created by smalll firms.” 

— Computer usage was twice as high among employees in the highest wage quar- 
tile compared with those in the lowest quartile. This relationship held for all 
firm sizes and lengths of job tenure. The overall average was 29.6 percent of 
workers using computers in the lowest wage quartile and 74.2 percent using 
computers in the highest wage quartile. The wage return to computer usage 
was present even among new hires in the under 25-employee firm, where the 
lowest wage quartile showed 21.6 percent of workers using computers and the 
highest wage quartile showed 58 percent using computers. To the extent that 
wage is based on the marginal value of worker product, computers are an im- 
portant influence for higher workerr productivity in firms of all sizes. 

— The highest premium for computer users over nonusers was found to be in 
small firms in industries with the highest growth rate, where a premium of 
nearly 24.8 percent in wages was observed. Fast-growing large firms did nearly 
as well, with an estimated 23.8-percent wage premium for computer users. 

— Computer usage was highest in fast-growing firms of more than 1,000 employ- 
ees, with 69 percent of employees using computers; it was lowest in slow growth 
firms with fewer than 25 employees where less than 31 percent used computers 
in their occupation. The author suggests that the 25-employee level may be a 
threshold for the adoption of computer technologies. 

— Occupations requiring information processing exhibit computer usage four times 
as high as occupations that are mostly production-oriented. Information-process- 
ing occupations show computer usage to be 71.9 percent for small firms and 
81.3 percent for large firms. 

— Women use computers at a higher rate than men in firms of all sizes. More 
than 60 percent of women in small firms use computers on the job; the rate for 
men is below 40 percent. 


ORDERING INFORMATION 

The complete report is available from: 

National Technical Information Service 

U.S. Department of Commerce 

5285 Port Royal Road 

Springfield, VA 22161 

(703) 487-4650 
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Prepared Statement of Senator Jon Kyl 

Small and medium size businesses are key elements in the robust American econ- 
omy. Experts have projected that a good number of small and medium-sized busi- 
ness may very well fail because of the Year 2000 computer problem. In fact some 
recent news articles across the country are citing projections that up to 12 percent 
of small business employing 50 people or less may be expected to declare bank- 
ruptcy. What would happen if 12 percent of the small businesses in the U.S. were 
to fail in the first quarter of 2000? How do we ensure that the supply chain nec- 
essary for commerce and defense remains unbroken? Making sure that small and 
medium sized business are prepared and have the resources they need is an impor- 
tant step. 

The good news is that a small business can often fix their problems faster; the 
bad news is that small businesses often do not have the “in-house” technical exper- 
tise or budgets to fix Y2K problems. The Passage of the “Year 2000 Information Dis- 
closure Act” (S. 2392) and the Year 2000 Readiness and Small Business Restructur- 
ing Act of 1998 (H.R. 3412) provide important resources for the business community. 
S. 2392 helps increase the flow of technical information needed for identifying and 
correcting problems, and H.R. 3412 helps ensure that small business can borrow the 
funds they to finance Y2K fixes. 

According to Frank Zarb, the chairman of the National Association of Securities 
Dealers, parent of the Nasdaq stock market, “I believe weTe in good shape but I’m 
still worried. We know, like everyone else does that there are going to be some cri- 
ses, so we formed crisis teams that can parachute in after that day.” I appreciate 
Mr. Zarb’s well balanced approach. I think this represents a realistic model for 
small and medium sized businesses. Know your vulnerabilities, do everything you 
can to prepare for Y2K and do not neglect your business continuity plans. 

It is in the best interest of every business to investigate their Y2K vulnerabilities 
and build the necessary business continuity plans. Small and medium sized busi- 
nesses are the biggest employers in the country, and it is essential that they make 
the transition to the next century in a well executed fashion. Mr. Chairman, I look 
forward to today’s hearing. 


Prepared Statement of Keith Mallonee 

Mr. Chairman and distinguished members of the committee: I am pleased to ap- 
pear today before the Special Committee on the Year 2000 Technology Problem. My 
name is Keith Mallonee. I am the vice president of systems development for 
McKesson Corporation. In keeping with the Committee’s request, I will provide a 
brief overview of McKesson’s program to address the Year 2000 or 19Y2K’ issue and 
respectfully request that my full written statement be included in the record of this 
hearing. 

McKesson is the largest national distributor of pharmaceuticals, health care prod- 
ucts, medical and surgical supplies, with sales in excess of $20 billion for our cur- 
rent fiscal year. Our customers are located in all 50 states, and include hospitals, 
independent pharmacies, chain drug stores, food stores, clinics, nursing homes, gov- 
ernment facilities, physician groups, HMD’s and surgical centers. 

Today I am here to share with you the importance of electronic commerce to our 
company, the preparations McKesson is making for Year 2000 and the state of our 
developing contingency plans. 

Electronic commerce is very important to the success of our business and the busi- 
ness of our customers. McKesson supplies pharmaceuticals and health care products 
to roughly 35,000 customers and processes about 60,000 orders containing 1.6 mil- 
lion order lines daily. Virtually all of these orders are sent to us by customers in 
some electronic form or another using everything from small hand held electronic 
devices that connect to phones to large mainframe computers. In addition, all major 
movements of funds including customer remittances and payroll are handled elec- 
tronically through electronic fund transfers. 

On the inventory management side of our business, we are equally dependent on 
electronic commerce. Roughly 80 percent of all trade goods purchased by McKesson 
are ordered through electronic data interchange, or EDI. Payments to our larger 
trade suppliers are also handled through EDI with commercial bank payment serv- 
ices. 
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McKesson has become very dependent on electronic commerce and we are taking 
great care to ensure the efficient functioning of this environment continues with 
minimal interruption as we enter the new millennium. 

How has McKesson prepared for the Year 2000? Just as we would any other 
major project. In 1996, we began with a survey of all of our operations to get a bet- 
ter appreciation for the scope and skills required. We then created a Year 2000 cen- 
tral project office for which I am responsible. In 1997, we began developing cor- 
porate-wide standards, dividing the problem into manageable projects, then develop- 
ing plans and budgets. 

Today we are finalizing software and hardware changes and testing the integrity 
of these changes extensively. We monitor our progress across the enterprise througli 
reports submitted on a regular basis to our central project office, our Chief Informa- 
tion Officer, an executive steering committee and ultimately to McKesson’s Board 
of Directors. McKesson’s Internal Audit Department has independent staff members 
conducting company-wide reviews of subsidiary and divisional Year 2000 efforts. 
The results of these reviews are presented to the Audit Committee of McKesson’s 
Board of Directors. 

McKesson’s executive management has identified Year 2000 as a top corporate 
priority. To that end, we have an estimated 400 people, including project managers, 
technicians, consultants, contractors and business partners working on the problem 
and we expect to spend between $30^0 million in making our systems ready. 

How are we progressing? A recent review by our financial auditors, Deloitte and 
Touche, found our progress and methods to be ‘best of class’, of which we are quite 
proud. As with any project of this magnitude and complexity, there are challenges, 
but at this point, McKesson does not foresee any serious obstacles meeting its Year 
2000 requirements. In general, McKesson plans to complete the final system 
changes required for Year 2000 compliance by June 1999. 

While McKesson has moved at a very fast pace to solve Year 2000 problems inter- 
nally, our ultimate success is very dependent on others, particularly our trading 
partners and the telecommunications, electric utilities and transportation indus- 
tries. As a result, contingency planning, while a normal part of our business, will 
become even more important as we approach the Year 2000. In the sales area, we 
will be capable of taking limited emergency orders manually and have provided vir- 
tually all customers with highly reliable hand held order entry devices to use in case 
their own systems fail. In our major data center, we have a diesel generator suffi- 
cient for normal operations with alternative telecommunication pathways and we 
can reroute inbound electronic orders to off-site systems. At the distribution centers 
we are prepared to pick emergency orders manually and ship product by any one 
of six modes. We have identified our most critical products and expect to have at 
least 45 days of supply on hand at the turn of the millennium. In addition, we are 
working to certify the readiness of our 2,000 inventory suppliers, with special atten- 
tion to all manufacturers of pharmaceutical products. 

McKesson has been in business since 1833. In the intervening 165 years, we have 
faced many challenges in supplying our customers the product they need within the 
timeframe they require. As an example. Hurricane Georges recently closed down one 
of our 36 distribution centers for 5 days. Similarly, we have encountered fires, 
floods, earthquakes, tornadoes, blizzards... and yes, even computer system failures. 
Even in the worst disaster McKesson has taken pride in being able to overcome the 
obstacles and deliver product when and where it is needed. With Hurricane Georges 
we quickly rerouted critical orders to two other distribution centers and continued 
to deliver without a serious disruption to our customers. Year 2000 is just another 

challenge and we will meet it just as we always have our customers have grown 

to expect that from McKesson. 

Mr. Chairman, we appreciate the opportunity to appear before the Committee 
today. These are critical issues facing our industry and we welcome your leadership 
in addressing them. I will be happy to respond to any questions that members of 
the Committee have, either now, or in writing following the hearing. 


Response oe Keith Mallonee to Questions Submitted by Chairman Bennett 

Question. How is McKesson avoiding the generic problems of IT interconnectivity 
both domestically and foreign with its EDI trading partners? 

Answer. Almost all of McKesson’s 35,000 customers are using McKesson-owned 
portable order entry devices that support both manual key entry or bar-scanned 
entry. These units are Year 2000 tested, are not dependent on EDI technology ex- 
cept for a working phone line, and have been in use by McKesson customers as a 
sole or alternative order entry device since the late 1960’s. 
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McKesson also offers customers an opportunity to transmit limited orders via any 
touch tone phone. 

If we have a Year 2000 problem with our telephone carrier, we can, to a certain 
degree, use alternate lines, hubs and carriers. At this point McKesson expects that 
if there are telephone problems, they will be local, if at all. 

Electronic fund transfers, normally accomplished through EDI, can be accom- 
plished by simple wire transfer. 

To limit the chance of Year 2000 EDI problems, all EDI trading partners have 
or will receive an invitation to participate in test EDI transmissions as a part of 
our Year 2000 effort. 

There are ready alternatives to EDI. For example, orders with EDI suppliers can 
be faxed, telephoned, FedEx’d, or even delivered by regular mail. 

In addition, McKesson has no suppliers using EDI with ordering points outside 
the United States for its core business of domestic drug and healthcare distribution. 

Question. To what extent is McKesson dependent on foreign suppliers and how 
do you expect to avoid the Year 2000 problem with them? 

Answer. Our core business (domestic wholesale healthcare distribution) purchases 
very little, if any, directly from foreign suppliers and any such transactions would 
be handled by non-electronic means (such as mail or fax). We do not, therefore, an- 
ticipate a direct Year 2000 issue with foreign suppliers for our domestic wholesale 
healthcare distribution business. It is difficult to fully evaluate our indirect exposure 
where, perhaps, McKesson deals with a company that purchases raw or finished 
goods from outside the United States. 

Our foreign subsidiary, Medis in Canada, also purchases exclusively within Can- 
ada. Medis is working on their own Year 2000 plan to include vendor Y2K certifi- 
cation. McKesson also has a minority interest in Nadro of Mexico but we have been 
unable to determine to what extent they purchase from foreign suppliers. 

Question. To what extent have you coordinated, negotiated or otherwise contacted 
your suppliers and customers to make certain that they will be Year 2000 ready? 
Will you continue to do business with companies that are not Year 2000 ready? 

Answer. A review of material relationships with suppliers of technology and trade 
goods was included in the McKesson Year 2000 project. 

We are participating in an industry effort organized by the National Wholesale 
Druggists’ Association (NWDA) to verify the Year 2000 readiness of trade suppliers 
with special attention to manufacturers of branded pharmaceutical products. The 
NWDA is the national trade association for pharmaceutical distributors. McKesson 
is dedicated to getting Year 2000 certifications from a list of suppliers identified as 
critical to our business; together these critical suppliers represent over 85 percent 
of McKesson’s purchases in 1997. 

Within the structure of the core project office at corporate headquarters is a team 
dedicated to trading partner issues. On a daily basis McKesson is communicating 
by phone and letter with major suppliers and exchanging information about mutual 
Year 2000 interests. 

On the non-trade side of the business. Year 2000 compliance statements were re- 
quired from all suppliers of McKesson’s computer hardware and commercial soft- 
ware starting in early 1997. As of October 1998, 70 percent of the computer hard- 
ware and purchased software used in the core business, wholesale drug and 
healthcare distribution, was compliant. Non-compliant technology was or will be re- 
placed by June 1999. 

McKesson has just established a web site containing a section devoted to Year 
2000 information. This web site will allow McKesson efficient and timely commu- 
nication with our trading partners and the public on key Year 2000 issues. The site 
is divided into 3 sub-areas: general information of possible interest to everyone, an 
area dedicated to customer concerns, and a separate area dedicated to supplier top- 
ics. 

At this point we are not aware of any supplier that has expressed serious doubt 
about their ability to become Year 2000 compliant. If a trade supplier is identified 
with serious Year 2000 problems, the decision to cease doing business with them 
will rest with our product and inventory managers. 

Question. What infrastructure availability did you assume in planning your Year 
2000 remediation and contingency plans? 

Answer. Most of our customers operate on a 19just-in-time’ inventory model. They 
assume that they can carry a minimal level of inventory because an order placed 
today will be filled by McKesson tomorrow. Because McKesson distributes pharma- 
ceuticals with health sustaining, and in some cases, life dependent attributes, this 
dependency is taken quite seriously. As I mentioned in my verbal and written state- 
ment to the committee on October 7, 1998, McKesson has been in business since 
1833 and has managed to deliver critical products despite all types of business dis- 
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ruptions, such as earthquakes, tornadoes, floods, fires and hurricanes. In some of 
those situations, distribution center phone lines have gone dead, power has failed, 
employees have been unable to get to work, computers have failed, and normal re- 
supply has been disrupted. In these cases, our local managers, administrative staff, 
sales people and warehouse employees have picked critical orders by hand or shifted 
orders to other distribution centers for filling. Critical product was moved from one 
distribution center to another to cover short-term supplier problems, and orders 
were faxed rather than transmitted by EDI. You can be very resourceful if some- 
one’s health and your business relationships require it. 

McKesson relies heavily on technology in its infrastructure and has moved aggres- 
sively to address both internal and external Year 2000 concerns. Because of our 
strong internal Year 2000 organization, we are becoming increasingly confident 
that, internally, our systems will successfully meet the Year 2000 challenge. 

We currently believe that the most likely risks of Year 2000 business disruptions 
are external in nature and may occur in telecommunications, electric, or transpor- 
tation services and with non-compliant smaller trading partners. Problems will 
probably be localized, non-critical and hopefully short in duration. The most serious 
disruption would be an extended and/or extensive communications failure. Such an 
extensive communications failure is not considered likely based on our monthly Year 
2000 reviews with major communications carriers, the flexible design of our net- 
work, and our use of backup and off-site systems. 

Question. How does your company rate the potential Year 2000 impact of micro- 
processors on your business? 

Answer. Internally, McKesson uses microprocessors in desktop and laptop com- 
puters, security systems, servers, controllers, telephone equipment, time keeping 
and reporting devices, portable intelligent scanning equipment used in our ware- 
houses, and in a multitude of other devices. At this time we are not aware of any 
internal situation where a device using a microprocessor would cause a serious im- 
pact on our business. It’s difficult to evaluate the potential external impact of micro- 
processors on our business, but I am not aware of any serious problems. 

Question. What percentage of your overall time will be spent testing as compared 
with time spent on remediation tasks? Will your testing phase extend beyond June 
of 1999? 

Answer. We estimate that at least 60 percent of our total Year 2000 effort will 
be devoted to testing. Testing is an important part of McKesson’s Year 2000 effort. 
All existing and modified computer code has, or will be, subjected to an extensive, 
well-defined, multi-tiered, series of tests. Throughout calendar year 1999 we will be 
conducting a rigorous final level of review called integrated testing under post-Year 
2000 conditions. 


Prepared Statement of Lou Marcoccio 

INTRODUCTION 

GartnerGroup is a worldwide business and information technology advisory com- 
pany, providing research and advice in more than 80 major focus areas of business 
and technology, including Year 2000. We research Year 2000 status, issues, and best 
strategies, and provide advice and methods to companies and governments through- 
out the world. 

Major points in this testimony: 

(1) Year 2000 worldwide compliance status 

(2) Predicted failures and impact 

(3) The impact of embedded chips 

(4) When system failures will occur throughout the duration of this problem 

(5) Risks to the United States and possible impact 

(6) Accuracy of disclosures reported to the U.S. SEC 

(7) Recommendations to the United States Senate 

Method of Measurement of Compliance Status: COMPARE (COMpliance Progress 
And REadiness): GartnerGroup uses a methodology for determining the status of a 
company or government agency. It is used to rank and compare level of completion 
of compliance. It consists of five levels: 

(1) Level 0 — Has not started any Year 2000 effort 

(2) Level I — Starting, awareness, champion identified, begin business dependency 
inventory 

(3) Level II — Conduct detailed inventory of all business dependencies 
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(4) Level III — Detailed project plans, resources in place, prioritize business de- 
pendencies, risk assessment, complete compliance of 20 percent critical items 

(5) Level IV — Complete compliance efforts on remaining 80 percent of critical 
items 

(6) Level V — Complete compliance of non-critical items and launch policies to 
guard against post year 2000 failures 

RESEARCH METHODS 

This information is gathered from interviews and client inquiry meetings. 
GartnerGroup is prohibited from disclosing specific names of companies or govern- 
ment agencies that are providers of this information, due to agreements of disclo- 
sure, under which the information is provided. Research data is gathered using var- 
ious research methods, e.g., client interviews, surveys, consortia groups, user compa- 
nies, equipment manufacturers, consulting firms, and legal firms. The research cov- 
ers 15,000 companies in 87 countries. An attempt was made to equally distribute 
the research across small (under 2,000 employees), medium (2,000 to 20,000 employ- 
ees), and large (over 20,000 employees) companies in each country, and to equally 
distribute across 27 vertical industries. We analyze the research and produce pre- 
dictions and analysis. This information is provided to clients in our written research 
and advice. Year 2000 status of companies and governments has been found to be 
quite different in each of three dimensions — size, industry, and country. 

RESEARCH RESULTS 

23 percent of all companies and government agencies have not started any Year 
2000 effort. 83 percent of these are small companies with fewer than 2000 employ- 
ees. 
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Figure 1 : Percent of Companies With Year 2000 Projects, by Size - 1998 

Why Companies & Government Agencies Began to Address This Problem 

(1) A failure occurred affecting a mission critical business process 

(2) Regulatory mandate and possible penalties 

(3) Fear of internal litigation due to lack of due diligence 

(4) Customer pressures 

Since awareness and failure scenarios have reached many countries, many compa- 
nies are now getting started because of fear of interruptions to their supply chain 
and pressure from customers. 
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Characteristics by Size 
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Figure 2 : Status of Companies and Government Agencies, by Size; Q31998 

Large companies are farthest ahead. They began earlier, because failures oc- 
curred, they had more resources to deploy, and they had older systems critical to 
their continued business operation. They spend a larger percentage of NOR (net op- 
erating revenue) on IT (information technology) than small companies. Smaller com- 
panies have fewer resources and less resource flexibility. A large percentage of IT 
systems at large companies were built in-house. Small companies have purchased 
a much larger percentage of IT systems from vendors. Since a majority of business 
insurance carriers recently added Year 2000 exemptions to current active business 
interruption policies, companies will not be able to rely on their insurance coverage 
as they planned. Many large companies have cash reserves and internal insurance 
strategies to rely upon, whereas small companies have limited safety nets or para- 
chutes. 

As of Q3 1998, large companies have completed remediation of 20-80 percent of 
their internal systems, and 30-50 percent have started significant levels of testing. 
Mid-size companies have 0-30 percent remediated, and 20-40 percent have begun 
testing. Small companies have 0-6 percent remediated, 30 percent have begun test- 
ing, and they are heavily reliant upon vendors to fix their systems. Large companies 
are using their own internal resources and contracting only 2-7 percent to outside 
vendors. Mid-size companies are contracting 25 percent to vendors, while small com- 
panies are contracting 50 percent to vendors. 

IT budgets were relatively flat from 1997 to 1998, however 30 percent of IT budg- 
ets will be spent on Year 2()00 efforts in 1998. We estimate 44 percent of IT budgets 
will go to Year 2000 projects in 1999. 

Small companies spend 60 percent of their Year 2000 spending on outside serv- 
ices, while large companies do most of the work themselves with already-existing 
internal resources. 

From 1996 through Q1 1998, companies were using vendor form letters to deter- 
mine supply chain risks. Many of these are not responded to, and of the ones re- 
ceived, the vast majority are unusable for compliance risk assessment. During Q1 
and Q2 1998, more than 60 percent have changed to a strategy of requesting face- 
to-face or telephone (direct contact) vendor reviews. This should help in obtaining 
more accurate supply chain risk information; however, many are struggling with 
trying to get vendors to agree to this type of meeting. Therefore, getting vendors 
to disclose accurate information related to compliance of their products remains a 
challenging task. 

Prior to 1998, 5 percent of companies had business participation or business own- 
ership of compliance efforts in their company. During 1998, this grew to nearly 30 
percent. We forecast that companies in which the IT organization “owns” the Year 
2000 compliance projects for the corporation are 3-5 times more likely to have a se- 
rious mission critical system failure (0.8 probability). 

The predominant focus of Year 2000 projects differ considerably, based upon the 
size of the company and country it is in. Large companies are now focused on con- 
tingency planning and assessing business dependency risks, while continuing to 
complete fixing of internal systems and beginning to test (see Figure 2). Mid-size 
companies are just beginning to address contingency planning, while attempting to 
assess supply chain risks and trying to leap-frog steps required to fix and text inter- 
nal solutions (see Figure 2). Many small companies have still not started, but the 
ones who have, are focusing on vendor compliance and inventorying their business 
dependencies (see Figure 2). 

In April 1997, 50 percent of companies, across all industries, had not started Year 
2000 efforts. By November 1997, the number dropped to 30 percent. By October 1, 
1998, 23 percent of companies throughout the world had not started. 83 percent of 
those are small companies. We predict that in January 2000, nearly 20 percent will 
still not be started, and they will mostly be small companies and companies in lag- 
ging countries (0.8 probability). 
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PREDICTED FAILURES BY SIZE 

GartnerGroup defines a “failure” as an interruption to a business operation, a 
business dependency which cannot be provided or delivered as required, or inaccu- 
racy of data or customer transaction. “Mission critical” is defined as any business 
dependency which, if it were to fail, would cause any of the following: 

(1) A shutdown of business, production, or product delivery operations 

(2) Health hazard to individuals 

(3) Considerable revenue loss 

(4) A significant litigation expense or loss 

(5) Significant loss of customers or revenue 

30-50 percent of companies and government agencies worldwide will experience 
at least one mission critical system failure (includes all sizes, all industries, all 
countries) through Q1 2000. In the U.S., 15 percent of companies and government 
agencies will experience a mission critical system failure (also see section on country 
status for status of U.S. versus all other countries). 10 percent of failures will last 
3 days or longer. The cost of recovering from a single failure after it occurs will 
range from US $20,000 — $3.5 million. 

The number of companies predicted to experience at least one mission critical sys- 
tem failure (0.8 probability): 

— 50-60 percent of small companies and government agencies 

— 40-50 percent of midsize companies and government agencies 

— 10-20 percent of large companies 

CHARACTERISTICS BY INDUSTRY SECTOR 

The second dimension used to gather Year 2000 status information is by industry. 
We monitor 27 industries, and find there are distinct issues unique to each industry. 
Very few of the industries are regulated. The industries have been placed into four 
risk categories. 

Figure 3 : Research Industries and Failure Predictions 


Category 1 . — Insurance, Investment Services, Banking, 
Pharmaceuticals, Computer Manufacturing. 

Category 2 . — Heavy Equipment, Aerospace, Medical 
Equipment, Software, Semiconductor, Telecom, Retail, Dis- 
crete Manufacturing, Publishing, Biotechnology, Consulting. 

Category 3 . — Chemloal Processing, Transportation, 
Power, Natural Gas, Water, Oil, Law Practices, Medical 
Practices, Construction, Transportation, Pulp & Paper, 
Ocean Shipping, Hospitality, Broadcast News, Television, 
Law Enforcement 

Category 4 . — Education, Healthcare, Government Agen- 
cies, Farming & Agriculture, Food Processing, City & Town 
Municipal Services 


15 percent of companies in these industries will experi- 
ence at least one mission critioal system failure. 

33 percent of companies in these industries will experi- 
ence at least one mission critioal system failure. 

30 percent of companies in these industries will experi- 
ence at least one mission critioal system failure. 


66 percent of companies in these industries will experi- 
ence at least one mission critioal system failure. 


Insurance, investment services, and banking lead all other industries. Banking 
has a unique status, since small banks are lagging and large banks in the United 
States are ahead of many other industries. The insurance industry began having 
failures more than 10 years ago, and due to the critical impact their IT systems 
have on their business operations, they began their compliance efforts early. Banks 
in the U.S. began having failure problems nearly 30 years ago, but were not driven 
to begin compliance efforts until they were driven by regulation. 

Infrastructure utilities and emergency services are critical for sustaining business 
operations and well-being. In the U.S., we predict that general infrastructure, 
power, non-wireless telephones, and critical services will continue mostly uninter- 
rupted, with potential for relatively minor problems and some inconveniences. Natu- 
ral gas utilities are lagging the utility industries. Healthcare lags in areas of medi- 
cal practices, hospitals and elderly care. Public, private, and higher education also 
lag far behind. Many world governments are also far behind. The U.S. and Cana- 
dian governments are more than 40 percent ahead of any other government in the 
world, but lag large, private industry in the U.S. State governments differ widely 
in status. Most U.S. states have Year 2000 projects. 50 percent have reached the 
start of level III, and nearly all are being managed and driven from within IT. 65 
percent of U.S. cities and towns do not have Year 2000 projects. Many mid-size and 
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smaller cities and towns are lagging far behind or have not started. An industry 
highly overlooked is agriculture (farming, food processing, transportation/distribu- 
tion, and import and export of foods and food bi-products). Several agriculture sub- 
industries are lagging far behind. Governments range from COMPARE level to level 
III, with the majority in level O-II. (see Figure 3). 
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Status by Industry — Worldwide 
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Figure 4 : Stains of Year 2000 Compliance - Industry Vierv 
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Figure 5 : Status of Year 2000 Compliance - U.S. Industry Vieto 
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CHARACTERISTICS BY COUNTRY 

The largest impact this problem with have on the world is related to the global 
economy. Countries already plagued with financial woes, sharp increases in infla- 
tion, limited monetary reserves, and high unemployment are some of the same coun- 
tries farthest behind with Year 2000 compliance. Figure 6 shows countries grouped 
according to level of risk and the predicted percentage of companies to experience 
failures. One white dot indicates that 15 percent of companies will have at least one 
mission critical system failure. One solid dot indicates that 33 percent of companies 
will experience such a failure. Two solid dots indicate that 50 percent will experi- 
ence such a failure, and three solid dots indicate that 66 percent will experience the 
same. Infrastructure risks within a given country are shown separately in Figure 
7. There are several key non-Year 2000 interdependencies considered when deter- 
mining risks within a specific country, e.g., rate of inflation, shortage of food or key 
resources, current government out of favor with majority of people, risk of unrest, 
infrastructure failure risks, ability to import/export key goods or resources, likely 
dependencies on other countries for aid, and monetary reserves and world value of 
their currency. A number of countries already afflicted with several of these prob- 
lems are considerably lagging in Year 2000 efforts, and will likely see even greater 
negative impact as a result. 

World Status 




Australia, Belgium, Bermuda, Canada, Denmark, Holland, Ireland, Israel, 
Switzer land, Swederv U.K., U.S.A., 


Brazil, Chile, Finland, France, Hungary, Italy, Mexico, New Zealand, Norway, Peru, 
Portugal, Singapore, South Korea, Spain, Taiwan 


A rgentina, Armenia, Austria, Bulgaria, Columbia, Czech Republic, Egypt, Germany, 
Guatemala, India, Japan, Jordan, Kenya, Kuwait, Malaysia- North Korea, Poland, 
Puerto Rico, Saudi Arabia, South Africa, Sri Lanka, Turkey, U.A.E., Venezuela, 


Afghanistan, Bahrain, Bangladesh, Cambodia, Chad, China, Costa Rica, Ecuador, 
Egypt, El Salvador, Ethiopia, Fiji, Indonesia, Kenya, Laos, Lithuania, Morocco, 
Mozambique, Nepal, Nigeria, Pakistan, Philippines, Romania, Russia, Somalia, 
Sudan, Thailand, Uruguay, Vietnam, Zaire, Zimbabwe 


In Alphabetical Order 
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Figure 6 : Research Countries and Failure Prediction 

In our country status and predicted failure rates within countries (Figure 6), the 
estimates include all companies and government agencies together. Venezuela start- 
ed awareness efforts months ago, but a large number of companies and government 
agencies have not yet begun compliance efforts. The new government leader may 
affect the rate of progress. In Argentina, companies are finding it somewhat difficult 
to get funding for Year 2000 projects and consulting firms needed to supplement 
smaller companies are limited in number. Except for Israel, Middle Eastern coun- 
tries are just beginning, and are lagging. In Russia, larger companies in just a few 
large cities are working on the problem, but companies throughout the country out- 
side those cities are lagging far behind. Municipal services, healthcare, and other 
Russian industries are far behind. In Pakistan and India, only larger companies 
have begun efforts. In Mexico, the banking industry is aided by a regulatory process 
that succeeds in getting relatively accurate disclosures made. This helped to get the 
banking industry moving more quickly than other industries. Two years ago, compa- 
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nies in Japan did not believe they had a problem with Year 2000, hut now many 
are tr}dng address compliance. 


Status by Geography — Worldwide 
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Figure 7 : Sample of Countnes Slwwhig COMPARt l evel 

The chart in Figure 8 shows the risk and probability of failure of basic infrastruc- 
ture by countries. It shows a ranking of 1 through 10 that describes how widespread 
and severe infrastructure and service interruptions are likely to be for each group 
of countries (grouped in Figure 6). Each failure effect is ranked in each country cat- 
egory according to how widespread the impact will be realized, and the level of se- 
verity expected. The chart takes into account today’s (as of Q3 1998) status and 
risks, interdependencies, levels expected to be reached by 2000, and likely failure 
results. Since some companies and governments will slow down or speed up their 
compliance efforts prior to 2000, and more and better status information is made 
available, this information will be updated periodically. 
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Infrastructure Predictions 
Distribution & Severity 
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1 No Impact 6 Moderate & Moderate 

2 Isolated & Minor 7 Moderate & Severe 

3 Isolated & Moderate 8 Widespread & Minor 

4 Isolated & Severe 9 Widespread & Moderate 

5 Moderates Minor 10 Widespread & Severe 

Distribution & Severity Scale 
Key 


Figure 8 : Distribution & Severity of Infrastructure Service Interruptions 

Note: countries included in the each of the four categories shown in Figure 8 are defined in Figure 6 

FAILURE SCENARIOS AND PREDICTIONS 

Each company and government agency is ranked according to its current status, 
its probability of gaining compliance, and the impact of technical systems on its typ- 
ical business operations. After following failures and tracking status related to prob- 
abilities of failure, we show the relationship of status to predicted mission critical 
failure in Figure 9 (below). We now know that it takes approximately 30 months 
for a mid-size company to complete level IV and gain compliance of their mission 
critical dependencies. 
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Time Based Risk 

Average Time to Level IV is 30 Months 


C 

O 

M 

P 

A 

R 

E 

L 

E 

V 

E 

L 


0 0 

/ 

%Complete 


Small Companies , 

Many, Developing Cout^tries 
Middle East<eQ<cept Israel) 


■ Healthcare 
Oil/Nat^al Gas| 
Education 
I.* Some Mid-Siz&l 
Companies 

• Chemidal. 

• Transportkton 



Risk p-er Compliance Status 


Largest Com panies 
Insurance’-, 
Investment Services J 
Banking 


.Russia, China, Iridia, Thailand, Philippines, 
-Middle ‘East, Arg^tina, Ven^uela, F(^d 
Processing, Government Sewices, Agricultura 


0.4 


T 


0.3 


1 


Probability of a Mission-Critical System Failure 


Figure 9 : Risk versus Compliance Status - October 1998 

Using the chart in Figure 9, you can estimate high-level risk and probability of 
at least one mission critical system failure occurring within any company in an in- 
dustry or government. This is done by using the current COMPARE status level and 
assuming it takes an average of 30 months for a midsize company to complete com- 
pliance of mission critical business dependencies. 


PUBLIC PANIC AND SOCIAL ORDER 

The economic and sociopolitical results from Year 2000 failures can include panic, 
unrest, increased crime, food and infrastructure interruptions, and health and safety 
issues. Social order may be affected when basic needs are disrupted. These affects 
are controlled by ensuring that basic needs will continue to be met and proactively 
reducing fear and disorder. Social disorder will be at risk in several countries and 
regions of the world, contributed to by Year 2000 failures. 


CORE 

To assess operational risk, to determine where contingency plans are necessary, 
and to develop contingency strategies, GartnerGroup uses a methodology called 
CORE (COMPARE Operational Risk Evaluation). It is used to determine risks relat- 
ed to supply chain, interdependencies, customers, investors, embedded systems, and 
IT systems. We recommend companies and agencies use CORE to determine oper- 
ational risks and risks related to global dependencies. 

CORE includes five steps or phases: 

(1) Perform High Level Risk Assessment 

(2) Inventory Business Dependencies 

(3) Categorize Business Dependencies by Impact to the Business 

(4) Perform Detailed Risk Assessment and Ranking 

(5) Design and Implement Contingencies & Disaster Recovery 

Use CORE to assess risks related to countries, infrastructures, industries, supply 
chain, or any business dependency. 
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ESTIMATED COST OF YEAH 2000 

We estimate the total cost of Year 2000 to be: 

— Worldwide IT Cost: U.S. $300 billion to $600 billion 
— U.S. IT Cost: U.S. $150 billion to $225 billion 
— U.S. $1-2 trillion: Total worldwide cost 

WHEN FAILURES WILL OCCUR 

System failures due to Year 2000 have been occurring for some time. They will 
increase in 1999, reach their highest volumes during 2000, and drop off during 
2001. Few will continue past 2003. Contributing factors (all are 0.8 probability): 

Software 

(1) 83 percent of commercial software is not yet certified compliant — 11 percent 
in April, 2002 

(2) 4 percent of follow-on versions of commercial software will not be compliant 

(3) 70 percent of custom solutions developed by a vendor more than seven years 
ago will not be supported by that vendor 

Data 

(1) 70 percent of archived data will not be remediated, but attempts will be made 
to use this data in remediated systems 

(2) Non-compliant data will be passed to/from companies 

(3) Some data centers will be shut down during rollover to reduce risk of failures 
Systems 

(1) Many IT systems will run non-compliant transactions during 1999, 2000, and 
2001, since many are periodic transactions 

(2) Some IT systems use applications that were frozen during 1999, but will be 
used again some time after 2000 


EMBEDDED SYSTEMS 

Embedded systems will have limited effect on Year 2000 problems, and we will 
see a minimal number of failures from these devices. Only 1 in 100,000 free-stand- 
ing microcontroller chips are likely to fail due to Year 2000. A small percentage of 
real-time clock-driven chips are affected, but these failures will be a small percent- 
age of the non-embedded system failures. The key issues concerning embedded chip 
failures are: (1) very few will fail, and (2) of those that fail, the majority will fail 
right at the millennium, and the majority of these will only fail once — if they are 
active when the clock ticks over. Embedded chips used for key infrastructure proc- 
esses, life support systems, and other critical processes should be checked and veri- 
fied by the manufacturer of the equipment, due to the potential severity and poten- 
tial result of such a failure. 

NUMBER OF COMPANIES & GOVERNMENT AGENCIES EXPECTED TO GAIN COMPLIANCE 

In October, 1998, 15 percent of all companies claim to have achieved level IV com- 
pliance of mission critical systems. We predict that 50 percent will achieve this goal 
by 2000 (0.8 probability). The majority of large companies in Category 1 countries 
will complete at least 80 percent of level IV by 2000 (0.8 probability). 
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Predictions 


1/1999 - 12/1999 - Fiscal year system failures begin to occur & testing begins 
11% of vendors default on compliancy of their products 
7/1999 - 3/2000 - 30-50% experience a mission critical failure (15% in U.S.) 
1/2000 - 1/2001 - 10% experience system failures within 12 months 
after Millennium 

1/2000 - 12/2001 - 1 1% of commercial software continues to be non-compliant 
Exact impact on the world economy is not possible to predict, however Year 2000 
will likely be one of numerous contributors to a negative impact over 3-5 years 



Figure 10 : Predictions and When Failures Will Occur 

POSSIBLE RISKS TO THE UNITED STATES 

Actions and proactive programs will be needed to keep these risks minimized, and 
keep them from materializing as described (see Recommendations). 

Domestic 

(1) Interruptions due to failures in interdependencies and interconnections be- 
tween companies and countries produce significant negative impact for U.S. busi- 
nesses and government operations 

(2) IT systems in critical industries will not be fixed in time 

(3) Global impact from Year 2000 is not adequately planned for and Year 2000 
fuels global recession much more than anticipated 

(4) U.S. foreign investments encounter disastrous results and significantly impact 
the U.S. investment market 

(5) Too many people lose confidence in the banking sector 

(6) Too many interruptions occur in food or medical supply chain 

(7) Local city and town governments cannot provide critical services 

(8) Foreign loans, pacts, and trade agreements are adversely affected 

Foreign 

(1) Public panic or loss of confidence in the banking sector in high risk countries 

(2) Global economy impacted by foreign business and government interruptions 

(3) Foreign loans, pacts, and trade agreements are adversely affected 

(4) Aid or bail-outs are needed for highest-risk countries 

(5) Foreign business interruptions impact too many U.S. companies 

(6) Foreign security issues ignited by unrest or severe economic issues 

(7) Key foreign government agencies experience significant failures 

RECOMMENDED ACTIONS FOR THE U.S. SENATE 

(1) The United States has no body or group tasked with full time monitoring and 
analysis of global risks the Year 2000 problem is likely to pose to the United States. 
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Even if advisory or consulting companies were to provide this information to the 
U.S. Senate or other bodies, a full time effort is needed to coordinate global risk 
assessments of U.S. and foreign governments and other risk threats from other 
countries on a regular basis — and, even more importantly, to take subsequent emer- 
gency action and launch pre-failure contingency plans to reduce risk and ward off 
possible serious effects. There also needs to be a focal point for providing risk infor- 
mation and warnings to the American public. 

Recommendation: Identify one current federal agency (as a Global Risk Manage- 
ment Agency) to manage and coordinate global impact of the year 2000 problem on 
the United States. Economic, financial, monetary, military, political, and other re- 
sources will need to be analyzed regularly, and quickly-developed strategies and 
contingencies will need to be launched across agencies, political governing bodies 
and foreign governments. This agency should report to the Executive Office, and 
have immediate access to the President’s Cabinet in matters of foreign policy, aid, 
funding, and national security. It should provide press releases, information, guide- 
lines, and warnings to the American public with regard to industries, infrastructure, 
government, and personal risks throughout 2001. 

(2) Many Eederal programs are administered locally, and many local governments 
lag in Year 2000 readiness. Therefore, interfaces between levels of government are 
at risk. These include interfaces and transactions that occur between local, state, 
and Federal Government Agencies. Local cities and towns are lagging far behind 
and need expertise, information, awareness, and aid, to combat the Year 2000 prob- 
lem. 

Recommendation: Launch U.S. -wide program to coordinate efforts with State and 
local governments and provide special local city and town government aid and infor- 
mation. This effort should be guided by the Global Risk Management Agency (de- 
scribed in number 1 (above). 

(3) Our experiences shows that U.S. companies are not providing accurate disclo- 
sures related to Year 2000 risks and contingencies. There are considerable dif- 
ferences between the status of Year 2000 compliance and critical risks that compa- 
nies disclose to the SEC, and what the actual status and risks are within that com- 
pany. This increases the risk of public investments being made without full under- 
standing of Year 2000 risks. 

Recommendation: Pass legislation or require the U.S. SEC to implement random 
audits as part of the Year 2000 disclosure and reporting requirements for publicly 
held companies in the U.S. We suggest a sample of audits be conducted by an out- 
side audit agency to confirm these findings, and then change the SEC policy to in- 
clude sample audits as part of the routine process of Year 2000 disclosure, if sub- 
stantiated with the sample audits. 

(4) U.S. Senate and U.S. federal government Year 2000 plans and contingency 
plans seem to assume that most failures will occur when we hit January 1st, 2000. 
As described in this testimony, failures will occur heavily from 1999 through 2001, 
and not over one single day or week. 

Recommendation: Set correct expectations in U.S. government agencies, with U.S. 
government contingency plans, and with foreign governments that the failure win- 
dow will be a three-plus-year period. Ensure that the SEC disclosure period and 
other Year 2000 regulatory government efforts are planned to last during the entire 
period needed. 

(5) Many lagging companies and government agencies in the U.S. are being asked 
to implement new regulations, rules, reports, and processes in their IT systems and 
data to support new federal requirements or legislation continually being passed by 
Congress (pertaining to a specific industry or segment, e.g. healthcare, education, 
telecommunications, etc.). This is a major contributor to lack of progress in these 
companies. Most best-in-class companies farthest ahead in gaining compliance have 
frozen or significantly reduced enhancements to current IT systems. This has al- 
lowed them to focus on fixing the systems and other business dependencies. 

Recommendation: Question all new legislation to determine if it may require IT 
modifications ( i.e., software, hardware, data, or automated reports) in federal, state, 
or local government agencies, or in private companies. Cease and desist from pass- 
ing or enacting any legislation that may affect IT systems or change reporting data. 
Such bills should be put on hold for an extended period, to allow companies and 
agencies to be successful in their compliance efforts. This will reduce the risk of 
non-completion of compliance for healthcare, education, and federal, state, and local 
government by 30-50 percent. 

(6) The U.S. Government efforts appear to be focused in two areas: (1) IT systems 
within federal agencies and (2) launching legislation to help support compliance 
within critical industries. It is now clearly evident that segments of companies and 
governments throughout the world will not be fully prepared to deal with this prob- 
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lem by 2000. Significant global impact will be realized without immediate action to 
avoid moderate or worst case results. 

Recommendation: We suggest adding a 3rd area of effort — managing global de- 
pendencies and risks. It’s critical to launch substantial contingency efforts in order 
to reduce global dependency risks prior to Q3 1999. These efforts may be conducted 
by the Global Risk Management Agency (described above). We suggest this new and 
additional focus be defined as a major component of U.S. national compliance ef- 
forts, and directly linked to the U.S. federal agency efforts, the Executive Office of 
the federal government, and the U.S. Special Committee on Year 2000. 

SUMMARY 

A great deal of progress has been made during the past year in the U.S. and in 
several parts of world. IT organizations in the U.S. have increased their spending 
for Year 2000 projects an average of 6 times over what was spent during 1997. Year 
2000 is now prioritized at the top, or number 2 (following Enterprise Resource Plan- 
ning system projects — to replace Legacy systems) by most U.S. companies. Large 
companies in the United States have made the most significant progress, and many 
of them will complete most of their compliance efforts hy 2000. Even smaller compa- 
nies in the United States have made significant progress in the past year, in several 
industries. 

Even with all of this progress, there are still very serious risks for the United 
States and throughout the world. The gap is widening even more, between compa- 
nies and governments farthest ahead and the ones farthest behind, since the lag- 
gards are moving much more slowly toward compliance. In the United States, indus- 
try segments such as healthcare, education, agriculture, construction, food process- 
ing, governments, and companies under 500 employees are lagging way behind in 
compliance efforts. Many of these will simply not finish critical systems by 2000. 

U.S. investors are provided very optimistic , often inaccurate, disclosures from 
publicly traded companies (to the U.S. SEC), and therefore accurate investment risk 
assessment data is not often available. This is likely to affect our U.S. market and 
several other economic factors as we get closer to 2000. 

Interdependencies and interconnectivity between companies and across country 
borders are also extremely high in significance related to Year 2000 risks. Many of 
these interdependencies are not being covered by either company, and many times 
these interconnections and data transfers cannot be easily tested. These are of criti- 
cal importance in banking, government, healthcare, and for many global manufac- 
turers. 

Even if we were to miraculously fix every one of these domestic issues and make 
certain all U.S. companies and government agencies will get themselves Year 2000 
compliant before 2000, the absolute largest risk to the United States and to U.S. 
citizens is the impact from companies and governments outside the United States. 
Far too many companies and governments critical to our continued strong economy, 
and providers of key resources, are more than 30 months behind private industry 
in the U.S. Since it takes an average of 30 months for a midsize company to achieve 
compliance of their most critical systems, many of these lagging foreign companies 
and governments will simply not have enough time to get their systems fixed before 
2000. Failures will lead to a negative impact on our economy and availability of crit- 
ical resources. We’ll see significant impact from failures in these regions, including 
economic, sociopolitical, investment shifts, market changes, critical resources, na- 
tional security, and defaults on federal loans. The only way now to combat this enor- 
mous issue, is for the U.S. Government to launch significant foreign contingency 
strategies in order to reduce or negate high risk dependencies on these industries 
and countries before we begin to feel these ill-effects. Since failures will increase in 
numbers throughout 1999, increase in volume throughout 2000, and continue at re- 
duced levels throughout 2001, the time to act on this is now. 


Prepared Statement of Senator Daniel Patrick Moynihan 

As we wind up the last Year 2000 (Y2K) hearing of this Congress, I would like 
to commend Senator Bennett and the Special Committee for its work in addressing 
the computer problem. The Committee has done a fine job in looking at all the as- 
pects of society that the Y2K problem affects: the utilities industry, the heath sector, 
financial services, transportation, government, and businesses. The Committee 
should also be applauded for the role it played in formulating and passing S. 2392, 
The Year 2000 Information and Readiness Disclosure Act. As an original cosponsor 
of this piece of legislation, I am pleased to see that its enactment is soon at hand. 
The head of the President’s Council on Y2K, John Koskinen, said that passing this 
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bill is one of the most important things that we could do on the Y2K front. I agree. 
I say well done to the Committee for all of the work it has done in such a short 
amount of time. 

It was almost two and a half years ago that I sounded the alarm on the computer 
problem. On July 31, 1996, I sent President Clinton a letter expressing my views 
and concerns about Y2K. I warned him of the “extreme negative economic con- 
sequences of the Y2K Time Bomb,” and suggested that “a presidential aide be ap- 
pointed to take responsibility for assuring that all Federal Agencies, including the 
military, be Y2K compliant by January 1, 1999 [leaving a year for ‘testing’] and that 
all commercial and industrial firms doing business with the Federal government 
must also be compliant by that date.” 

January 1, 1999 is quickly approaching. I believe that we have made progress in 
addressing the computer problem and that the “Good Samaritan” legislation will 
play a significant role in ameliorating this problem. But much work remains to be 
done. For the next 450 days we must continue to work on this problem with dedica- 
tion and resolve. 

Historically, the fin de siecle has caused quite a stir. Until now, however, there 
has been little factual basis on which doomsayers and apocalyptic fear mongers 
could spread their gospel. After studying the potential impact of Y2K on the tele- 
communications industry, health care, economy, and other vital sectors of our lives, 
I would like to warn that we have cause for fear. For the failure to address the mil- 
lennium bug could be catastrophic. 


Prepared Statement of Dr. Charles Popper 

Good morning Mr. Chairman and members of the Committee. My name is Charles 
Popper and I am Vice President of Corporate Computer Resources at Merck & Co., 
Inc. In that position, I serve as the chief information officer of Merck. 

Thank you for inviting me to participate in today’s hearing on the Year 2000 prob- 
lem. I applaud this Committee’s efforts in both investigating and publicizing the po- 
tential effects of this very serious and prevalent computer bug. I would like to dis- 
cuss what my company, Merck, is doing to deal with the problem. I would also like 
to provide a broader context that you may find useful. 

Merck is a global research-driven pharmaceutical company that discovers, devel- 
ops, manufactures and markets a broad range of medicines, directly and through 
its joint ventures, and provides pharmaceutical benefit services through Merck- 
Medco Managed Gare. Merck remains the oldest and largest U.S. -based company 
dedicated to innovative vaccine research, development and manufacturing. Merck 
believes in focusing its efforts on the discovery of important new medicines. The 
Company will spend almost $1.9 billion on research and development in 1998. 
Merck’s pharmaceutical manufacturing operations encompass 30 plants worldwide 
in the United States, Europe, Central and South America, the Far East and the Pa- 
cific Rim. 


Y2K AND MERCK 

As you know, the Y2K bug can potentially affect any computer program that proc- 
esses dates, including software application programs, operating system programs, 
and firmware programs that are embedded in countless devices that are relied upon 
by companies and consumers alike. Our task at Merck has been to ensure that all 
such programs that are in use anywhere within Merck’s world wide operations will 
operate correctly throughout the transition to the new millennium. 

But our objective all along has been a more important one, consistent with 
Merck’s company mission. As George W. Merck stated many years ago, “we try 
never to forget that medicine is for people.” Merck is solving its Y2K problem is 
order to ensure that we can continue to discover, develop, manufacture, and distrib- 
ute medicines that treat important human diseases. Our paramount goal is to en- 
sure the continuity of the supply of medicines to our patients. 

MERCK’S Y2K PLAN 

We are doing so by following a simple strategy. 

— First, we have inventoried all computer systems, applications, and devices with 
embedded processors. 

— Second, we have assessed each of these systems to determine whether it in- 
cludes any date processing and whether its correct operation is of serious con- 
cern to our business. As an example of a system where we are less concerned 
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about a possible Y2K bug, consider a program that reports monthly sales and 
organizes the columns of the report in chronological order. While we prefer to 
have the report continue to show the most recent results from right to left, if 
the Y2K bug were to merely cause the columns to print in a different order, 
this would be only a minor concern. We are deferring the repair of such bugs 
to the final stages of our Y2K project. 

— Third, we have developed a compliance strategy for each system. That is, we 
have decided whether to repair the software, to replace it with a newer version 
that is Y2K compliant, to retire the system from active service, or to simply let 
it fail (as in the above sales report example). 

— Fourth, we are executing the strategy for the many thousands of systems in our 
inventory. This is obviously a daunting task, because of its magnitude and its 
geographic diversity; we have to deal with systems in the many hundreds of 
Merck locations world wide. Hence we have put in place an elaborate manage- 
ment tracking and control system, to ensure that nothing falls through the 
cracks. 

— The fifth and final step is to thoroughly test all of our systems. Our attitude 
is to trust no one but ourselves. If a system vendor tells us that their applica- 
tion is Y2K compliant, we will insist on testing it ourselves or at least auditing 
in detail the test results provided by the vendor. We have already found in- 
stances of applications certified compliant by the vendor that, in fact, did not 
pass our tests initially. 

Our goal has been to achieve Y2K compliance by the end of this year, thus allow- 
ing all of 1999 for dealing with the inevitable glitches and inconsistencies among 
systems. We have also planned from the outset to use 1999 for the global deploy- 
ments of remediated systems. Many of our systems and applications are deployed 
in multiple manufacturing plants, headquarters sites, and research laboratories. It 
is really not necessary to deploy the corrected system ever 3 rwhere this year; it suf- 
fices to successfully test one instance of the system, so that we can safely plan addi- 
tional deployments next year. The actual deployment schedule is designed to mini- 
mally disrupt our ongoing operations. 

As you can imagine, Merck’s Y2K Project is a very significant effort. We began 
reasonably early, in 1996. There are now in excess of several hundred people in- 
volved; we are spending many tens of millions of dollars to plan, execute, and man- 
age this work. By starting early, we were able to schedule the resources in such a 
way as to have less impact on both ongoing business operations and the other infor- 
mation technology initiatives so important to Merck’s continued success. 

MERCK’S BUSINESS PARTNERS AND Y2K 

Fixing our internal systems is only part of the problem. Merck, just as any global 
company, works with many thousands of business partners, suppliers, customers, 
and government agencies. Our ability to continue our company’s operations success- 
fully in January of the year 2000 depends just as much on the Y2K programs of 
these companies and agencies as on our own internal systems. Hence we have orga- 
nized two other major sets of activity: 

— Each business area is examining its business partners to assess its Y2K risk. 
If the proper operation of that entity’s systems is essential for Merck’s oper- 
ations, we are both working with that entity to better understand its Y2K reme- 
diation plans and also developing internal contingency plans just in case that 
entity fails to achieve Y2K compliance on time. 

— We are also working as part of the VitalSigns 2000 Project, an effort sponsored 
by the Odin Group, to gather important information about the Y2K compliance 
of the entire health care industry in which we participate. This is the only sys- 
tematic effort of its kind, whose objective is to map out the cross-industry proc- 
esses that together provide American patients with health care services. The 
VitalSigns 2000 team has developed a survey instrument for the five groups of 
entities comprising the health care industry: payers, providers, suppliers, dis- 
tributors, and government agencies. The survey is collecting information about 
the Y2K readiness of each of these sectors, as well as their interdependencies. 
By understanding the cross-industry processes and their Y2K vulnerabilities, 
we, together with the rest of the industry, can develop the detailed contingency 
plans that can assure the continuity of high quality patient care. 

Y2K AND THE PHARMACEUTICAL INDUSTRY 

What about the broader American pharmaceutical industry? While I obviously 
cannot testify about the detailed plans and projects of Merck’s competitors, I have 
had the opportunity to discuss the Y2K problem with my colleagues in other phar- 
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maceutical companies, as we’ve worked together within PhRMA, the Pharmaceutical 
Research and Manufacturers of America. These companies have all followed a meth- 
odology similar to Merck’s and are applying the level of resources needed to deal 
with the problem. They have also recognized the broader issue of the readiness of 
business partners and are developing appropriate contingency plans. 

We hope that our colleagues and counterparts elsewhere in industry and govern- 
ment are diligent in their efforts, so that America’s health care system is unaffected 
by Y2K. 


CONCLUSION 

Let me close with some broader context. I read periodically about companies and 
agencies that are just now waking up to the severity of the problem. Worse, I still 
read and hear about entities that still do not believe that there is a serious problem. 
They may be right, in their local situation, but only an organized testing program 
will allow them to be sure. So I do worry about what will happen as the clock 
strikes midnight December 31, 1999. 

The key to success will be our overall preparedness. Hence the work of this Com- 
mittee is of vital importance. It is essential that you keep the pressure on both in- 
dustry and government, both to minimize the number of system failures we experi- 
ence and to maximize our readiness to deal with the problems that do occur. 

Again, I thank the Committee for the opportunity to be here today and look for- 
ward to your questions. 


Responses of Dr. Charles Popper to Questions Submitted by 
Chairman Bennett 

Question 1. Mr. Popper, Merck & Co. is as international in its operations as an 
American company can get. You have heard Mr. Marcoccio’s comments on the sever- 
ity of the international Y2K problem. From your perspective as the CIO of an inter- 
national company, what more do you think the United States should be doing to 
head off this developing storm cloud? 

Answer. I believe that the U.S. should focus on two key areas. First, we must pro- 
vide strong leadership on the Y2K issue by setting an example for other countries. 
All segments of the federal government must do whatever it takes to prepare for 
the Millennium Bug — there must be adequate plans as well as determined manage- 
ment and follow up. We need to demonstrate to other governments both the serious- 
ness of the problem and the techniques and resource commitment needed to address 
it properly. Second, we should work to enable adequate international disclosures of 
Y2K readiness. We can do this by encouraging other countries to emulate the re- 
cently enacted Year 2000 Information and Readiness Disclosure Act [S. 2392], and 
by working through the appropriate international organizations to enact similar 
international protection. 

Question 2. Laurene West testified about her personal medication Y2K problems, 
which provides a unique perspective. How do you see the pharmaceutical supply 
chain responding to that kind of short shelf-life medication issue? 

Answer. I believe that the supply of short shelf-life medications to patients can 
best be assured by allowing each pharmaceutical company to address its own spe- 
cific problems. Each company knows its products, its customers, and its supply 
chain alternatives best. Each company can therefore develop the contingency plan 
that best meets its unique situation and the needs of its customers, including the 
issue of short shelf-life medications. Any broader action — especially one that at- 
tempts to implement a common contingency plan — would only add risk, by putting 
all of our eggs into one basket. 

Question 3. Recently, the CIO of another major pharmaceutical company told our 
committee that in the next 3-6 months they will begin a “flight to excellence” which 
means the company will begin cutting off suppliers or business partners who cannot 
demonstrate that they Y2K ready. Is Merck considering any similar actions? Would 
you consider this “flight to excellence” a good way to promote Y2K readiness on a 
business to business level? 

Answer. Merck is certainly examining all of our suppliers and business partners, 
and, if we are not satisfied with their plans for Y2K readiness, then we are formu- 
lating contingency plans. One element of the plan might include seeking alternate 
sources for those goods or services. An alternative is assuring the availability of sup- 
ply through the expected duration of supply chain interruption. The key is to de- 
velop and implement an effective contingency plan for each critical product or serv- 
ice, drawing upon our knowledge of the state of readiness of our suppliers and part- 
ners. In this way, we can ensure that we continue to meet our customers’ needs. 
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Question 4. Mr. Popper, the pharmaceutical products your company produces are 
dependent on suppliers for ingredients and distributors for sales to the ultimate con- 
sumer. Where do you see the most critical interconnectivity points? 

Answer. Our analysis of the Y2K risks created by our suppliers and customers 
is an ongoing effort, which we expect to continue throughout the balance of 1998 
and all of 1999. So it is inappropriate to identify the most critical risks on a “once 
and for all” basis. Right now, our assessment is that the most important risks are 
within the power utility, transportation, and government sectors. 

Question 5. Mr. Popper you mentioned the VitalSigns 2000 Project that Merck is 
participating in as a contributor. How do you see this helping to bridge the Y2K 
problems in the Health Care industry? 

Answer. The Vital Signs 2000 Project, sponsored by the Odin Group, is intended 
to identify the major Y2K risks of the entire pharmaceutical supply chain, including 
suppliers, distributors, providers, and payers. The survey will identify those indus- 
try segments (or their suppliers) who are less likely to be prepared, so that we can 
prioritize and prepare good quality contingency plans. We are also working to de- 
velop templates for contingency planning that will be made available to the entire 
industry. We expect two benefits from this effort. First, it will enable even small 
companies to prepare good quality contingency plans. Second, it will allow all com- 
panies to more easily examine the readiness of their business partners in a standard 
way; this too will facilitate better and more consistent contingency plans. 

Question 6. Mr. Popper, we’ve heard a lot today about small and medium sized 
businesses. We heard from another witness that these firms tend to “not” pay atten- 
tion to the Government and it’s communications. However, they do listen to their 
trade associations. Do you think enough is being done to inform the small and me- 
dium sized players in the pharmaceutical sector? What more can be done, say with 
trade associations? 

Answer. I believe that a reasonable answer to the issue of small and medium 
sized players will emerge from the Vital Signs 2000 survey; prior to analyzing the 
survey results, I cannot assess how ready these industry segments will be. Using 
trade associations to inform and support smaller companies is probably a good idea. 
Here, too, it might be feasible to leverage the template and contingency planning 
expertise developed by the Vital Signs 2000 project. 

Question 7. Mr. Popper, could you please describe to the Committee the kind of 
contingency planning that is required for a firm of your size to cope with the Year 
2000 problem? 

Answer. In brief, our challenge is to be prepared for all reasonable contingencies. 
We have identified all of our suppliers of both goods and services, and we have as- 
sessed the risk and impact of supply interruptions for each supplier. We then 
prioritized the suppliers based upon this risk/impact assessment. Finally, we are 
working through this prioritized list to prepare reasonable contingency plans. In ad- 
dition, we intend to form emergency response teams to deal with the unexpected 
problems that will inevitably arise when we roll over into the new millennium. 

One caveat is in order. There are contingencies that are impractical for even 
Merck to prepare for. For example, it is conceivable that scattered electric power 
outages could spread via the power grid to black out major portions of the country. 
We cannot prepare to overcome such a circumstance. This is, in fact, where we rely 
upon the U.S. government to help. If it were concluded that scattered power outages 
are likely or even possible, we would hope that there would be planning at the fed- 
eral level to prevent these from spreading. As our own planning proceeds, we would 
be happy to share with the Committee any findings of similar contingencies that 
we believe would benefit from federal attention. 


Prepared Statement of Rod Rodrigue 

It is an honor to be before this Committee to bring to you information with re- 
gards to the Year 2000 problem. All of you have been inundated with studies which 
attest to the negative economic impact on this country’s 384,000 manufacturers. 

A national study indicated that 7 percent of small manufacturers could shut down 
and an even greater number would experience varying degrees of business interrup- 
tions. The national negative impact exceeds $150 billion. It is our estimate that if 
these figures hold true, Maine would experience a negative impact in excess of a 
quarter of a billion dollars. 

I am here today with good news that there’s a national system armed with an 
effective tool to positively impact the Y2K problem. Several months ago the Depart- 
ment of Commerce’s NIST/MEP program developed an assessment tool, which al- 
lows MEP engineers to quickly, and accurately organize the broad spectrum of Y2K 



105 


issues faced by today’s small and medium-size manufacturers. The use of this 
project management tool gives the small manufactures a road map for addressing 
the most critical issues such as accounting systems, computerized production equip- 
ment, environmental management systems, as well as external threats. 

The most exciting aspect of this tool is that it now resides in the hands of 2,500 
men and women located in 400 offices in 50 states and that its implementation can 
be coordinated under a single unified national effort at MEP headquarters. The 
MEP centers are linked to over 3,500 partner agencies, which can be called upon 
to help disseminate the Conversion 2000 tool. I believe that for the first time we 
can present to you a viable mechanism for attacking the millennium problem. 

Under the leadership of Senators Snowe and Collins Maine has progressed beyond 
the design stage and proceeded directly into implementation in over 100 companies. 
Utilizing a call center in contacting 2,500 Maine manufacturers, we confirmed what 
many studies have concluded. Despite having knowledge of the Year 2000 problem 
over half of the small manufactures had no plan to take any action before the turn 
of the century, and those who wanted to act were having great difficulty in organiz- 
ing a systematic approach to the problem. After recognizing that between 500 to 600 
small Maine manufacturers would need immediate assistance, the Maine MEP built 
a broad-based coalition which included Chambers of Commerce, Economic Develop- 
ment Districts, Small Business Development Centers, volunteers and business visi- 
tation specialists. These agencies, as well as independent consultants, will be 
trained by MEP engineers to deliver the Y2K assessment tool throughout the Maine 
manufacturing community. 

Technical experts will staff Y2K hot lines on a 24-hours basis. Once the assess- 
ment has been completed MEP engineers will generate a report which clearly de- 
fines the necessary remedial steps. Accompanied with this report will be a single- 
page instruction sheet on how to apply for a Small Business Administration (SBA) 
LowDoc/Fastrack loan. The finalized report will not only facilitate loan processing 
but will also provide a standardized industry accepted document which will dem- 
onstrate the manufacturers due diligence in becoming compliant for their banks and 
other trading partners. 

As president of the Maine MEP I have been asked what the committee can do 
to assist small manufacturers at this crucial juncture. On behalf of the millions of 
men and women who work in small and medium-size manufacturing facilities, I re- 
spectfully request the committee to appropriate the necessary funding to allow the 
MEP system to implement the Y2K tool at the national level. It is important to un- 
derstand that this is an assessment tool and that we must complete this work on 
an expedited basis in order to allow these manufacturers to complete the identified 
problems in time. 


Addendum to Rod Rodrigue’s Testimony 

Along with the testimony submitted at the Y2K hearing, I believe that it is in- 
cumbent upon me to mention the importance of appropriating additional funding to 
help the Manufacturing Extension Partnership’s (MEP) initiative in developing a 
national Y2K program like Maine MEP’s. The MEP is committed to helping U.S. 
manufacturers in addressing the Y2K issues. To implement the Y2K program addi- 
tional resources would assist states like New Jersey. Robert Loderstedt, President 
of New Jersey MEP, has indicated to me that of the 13,000 small manufacturers, 
New Jersey faces a potential closure of 1,000 businesses in Year 2000 and between 
2,000-3,000 others needing assistance in becoming Y2K compliant. Although Maine 
needs additional appropriation to address the Y2K problems. New Jersey, as well 
as other states, clearly has a great financial need in tackling their manufacturers’ 
Y2K issues. 


Responses of Rod Rodrigue to Questions Submitted by 
Chairman Bennett 

Question. In your testimony regarding the NIST/MEP Conversion 2000 assess- 
ment tool, you indicated that within Maine you have progressed beyond the design 
stage with over 100 companies engaged using the tool and MEP assistance. When 
did these efforts start? How long does it take to complete an assessment with Con- 
version 2000 and MEP representatives? What can you tell the committee about the 
results of those efforts to date? Are there any lessons learned to share at this point? 

Answer. The efforts started in early September as soon as we had first results 
from our call center that was set up to directly, individually, and personally raise 
manufacturer awareness of the Y2K problem. 
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Complete assessments with Conversion 2000 and a MEP representative are deter- 
mined by the size of the company and scale of their specific problem. We have some 
companies that are relatively small and without significant computing resources 
that feel they don’t need any help at all. We can educate them that Y2K is not just 
an internal computer problem but a more generic business problem with both inter- 
nal and external considerations. These companies, once aware of all the potential 
exposures, can be helped fairly quickly (one or two visits and letters between suppli- 
ers) because of their limited exposure. For other companies it has taken our very 
pointed calling awareness program to bring focus to the Y2K process (quite late I 
think) and they are in much more significant jeopardy, taking longer to complete. 
A case in point is one company that sources all it’s raw materials from five different 
European countries with five currencies, has a third party broker to clear customs 
for these products, and being a catalog company depends on another third party 
mailing list provider for its market. This company also has manufacturing oper- 
ations that may have an embedded chip concern. Considering that Europe is signifi- 
cantly behind the United States in its Y2K efforts and that the Euro common cur- 
rency will be rolled out at the same time as Y2K hits, this company has a much 
more complex situation than others and will take longer to assess. This is only one 
case but there are many more that once a MEP representative has called and ex- 
plained the whole realm of possibilities are finding that this is in fact a real problem 
for them that they are having to deal with and are not prepared. 

To date we have identified through our call center 250 Maine companies that have 
indicated they would like to have a field engineer call. We have assigned MEP rep- 
resentatives to 206 of these companies and are currently working directly with 30. 

There is a lot of apathy in the marketplace and it takes a concerted effort to get 
businesses to recognize their exposure. This is more of a problem for companies than 
they originally recognized and they have to devote more time to it than ever envi- 
sioned. MEP needs to be involved in the assessment phase because without some 
concerted effort many of these companies will not come to the process until it’s too 
late. MEP needs to provide funding for the assessment phase of Y2K because it’s 
a good investment in our business future. A small expense now in assessment can 
mitigate far larger costs later. 

Question. You have asked the committee to appropriate the necessary funding to 
allow the MEP system to implement the Conversion 2000, Y2K tool, at the national 
level. What is the necessary funding needed at the national level? How would you 
propose that the funds be administered to discourage abuse and encourage proactive 
Y2K efforts? If federal funds were made available for a national MEP effort, how 
would you propose those non-manufacturing businesses are given similar assist- 
ance? Is it appropriate for the Federal Government to accept these costs and where 
should it stop? 

Answer. Based upon our estimates for the needs of Maine manufacturers, we be- 
lieve the funding needed at the national level is at least $50 million for expanding 
the Y2K outreach initiatives of the MEP system. These funds would be best man- 
aged through the national MEP program, as the federal funds added to the coopera- 
tive agreements of the manufacturing extension centers would leverage the match 
funding requirements from the states and local partners. This means that if the 
Federal Government provides half of the needed total, the match funding require- 
ments would effectively bring $50 million in resources to bear upon this critical 
need. 

An expanded MEP outreach effort would benefit non-manufacturing businesses 
through expanded partnerships with Export Assistance Centers and Minority Busi- 
ness Development Centers within the Department of Commerce, Small Business De- 
velopment Centers (SBDC’s) of the SBA, and Department of Agriculture extension 
offices. We have been working with the SBDC’s of Maine to help streamline the loan 
approval process for SBA Y2K remediation project loan guarantees. The Utah and 
Iowa MEP centers have partnered with SBDC’s to provide Y2K awareness materials 
and presentations. The Department of Commerce recently signed an MOU with the 
Department of Agriculture under which MEP is providing Y2K awareness materials, 
Y2K Self-Help Tool, and training. Discussions are continuing with the Department 
of Agriculture and SBA for replicating these successful partnering models across the 
national system, if additional funds become available. 

The MEP Y2K outreach program takes a company through the awareness phase 
and helps a company determine which of its systems are not Y2K compliant. It then 
helps a company plan the necessary remediation and identify the resources required 
to implement the corrective actions (such as SBA loan guarantees). At that point 
it is the company’s decision to commit its own resources to proceed with the remedi- 
ation project. Federal funds will not be used to repair systems for companies, but 
we believe that it is appropriate for the Federal Government to expand its Y2K out- 
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reach efforts in continuing awareness and assessment activities to help small busi- 
nesses identify the extent of their Y2K problems. 

Question. As a result of the Conversion 2000 assessment process is a report defin- 
ing necessary remedial steps generated by MEP engineers, according to your testi- 
mony. You note the report will both facilitate SBA loan processing and demonstrate 
due diligence. Has the SBA agreed to accept this report as the basis for expediting 
loans? How do small manufacturing companies using Conversion 2000 generate this 
report? Will the SBA accept a report not generated by a non-MEP engineer? 

Answer. For matters of SBA policy please contact Kris Swedin, SBA Associate Ad- 
ministrator for Legislative and Congressional Affairs. Kris may be contacted at SBA 
headquarters at 202-205-6700. 

Maine MMEP, Maine SBA and the Maine SBDC have developed a partnership 
where the MMEP Assessment will be utilized by the SBDC to put together the fi- 
nancials and business plan for any company needing capital to meet it’s Y2K needs. 
The SBA will work with the SBDC and it’s lending partners to ensure that no busi- 
ness lacks the capital for Y2K conversion. We believe that this model could be used 
in other states. 

Question. The need to continue awareness campaigns at this late date continues 
to trouble this committee. However, it is been more troubling that once made aware 
of Y2K issues, over half of small and medium size manufacturers in Maine plan to 
take “No Action.” Would you please describe your sensing of why this course of ac- 
tion (“No action”) is selected over 50 percent of the time? What is being done to edu- 
cate them as to the consequences of taking “no action”? 

Answer. We believe that the reason for many companies deciding not to act is the 
lack of a complete understanding of the pervasiveness of the Y2K problem and how 
it can effect their business. Many companies are “generally aware” of the problem, 
but have not taken the time to investigate the potential effects of failures within 
external organizations upon which they rely, within their own embedded systems, 
or in their “relatively new” systems which they assume are compliant. A more 
proactive and detailed awareness campaign is needed to target this large group of 
small businesses to break through these misperceptions and apparent apathy about 
the Y2K problem. A portion of funds made available for expanding the national 
MEP Y2K outreach effort would be used for a more in-depth awareness campaign 
for small businesses. 


Prepared Statement of Harold Schild 

Chairman Bennett and committee members, I thank you for providing me an op- 
portunity to share with you our experience as a relatively small, farmer owned, 
dairy cooperative, in dealing with the year 2000 computer problem. I’ll provide you 
with the full text of my comments but only recap the highlights in my remarks here 
before you today. 


FIRST NOTICE 

We were first made aware of possible Year 2000 problem during February 1996 
audit of our 1995 financial records by a big five auditing firm. 

At the management level, we authorized our Management Information Services 
staff to research the validity of the potential for problems in our computer systems. 
They reported that there was indeed a real danger of a complete calamity when 
January 1, 2000 rolled around and we should begin immediately to work toward cor- 
recting the problem. 


MAGNITUDE OF THE PROBLEM 

TCCA is a 150 member dairy cooperative nestled between the Coast Range Moun- 
tains and the Pacific Ocean 75 miles west of the Portland, Oregon metro area. The 
association has sales of about $160 million, totally in branded, value-added dairy 
products, primarily cheddar cheese, a small sample of which I’ve shared with you 
today. 

At the time we became aware of the Y2K problem we had an M.I.S. staff of two 
people. Despite our efforts, we have been unable to attract additional staff to our 
coastal area to cope with every day programming demands, plus deal with the Y2K 
bug. Many other companies, IN THE METRO AREA, able to pay higher salaries, 
have engaged most of the qualified PROGRAMMERS in the region. 

Our approach was to form teams that would think of all the potential problems 
in their areas. Some of our people were sent to seminars to gain a better under- 
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standing of where to search for the Y2K bugs. A few of the potential problem areas 
they found were: 

1. Accounting software 

2. Electronic Data Transfer (E.D.I.) between TCCA and customers 

3. Member and employee payroll 

4. Point of sale programs (Visitor’s Center/Farm Store) 

5. Were our suppliers compliant 

6. Legal issues — performance agreements 

7. Financial transactions — customer payments 

8. Order reception and processing — customers complaint? 

9. Automated product processing — ^would the plant produce product? 

To date, our accounting department estimates that our out of pocket, cash expend- 
itures will exceed $1 million to avoid a major Y2K problem. This does not include 
any of the internal cost of staff time or expense for training. The loss of productivity 
internally, because our people were busy with Y2K, is also not included in this cost 
estimate. This cost will be directly borne by our dairy members many of whom are 
struggling to make ends meet already. 

CURRENT STATUS 

At the present time, we are applying a test program to all of our software to de- 
termine if all bugs have been exterminated. We are confident that TCCA will be 
Y2K ready before the fall of 1999 if we do not experience delays in receiving soft- 
ware, which we have contracted for installation April 1, 1999. We expect no prob- 
lems, but then Tm sure there will be some surprises, there always are. 

FOOD industry’s READINESS 

Many CEO’s of dairy companies I talk to express a wide range of views on Y2K 
from disbelief that it is more than a computer industry hype to stimulate business, 
to a view that the electronic world as we know it will cease to operate, leaving com- 
merce stalled, utilities shut down, and only hand operated equipment functioning. 
Some project no additional cost to compljdng with Y2K requirements while others 
estimate their costs will, like ours, exceed $1 million. 

As in many other industries, the large, well financed seemed to be better prepared 
than those who are less sophisticated and more personally operated. I would rate 
the dairy industry as possibly receiving a “C” for overall preparedness. 

WHAT CAN CONGRESS DO TO HELP? 

Many persons are not aware of the real potential for disaster that exists. This 
committee is an excellent vehicle toward a broader awareness level nationwide. 

Some suggestions for Congress to act upon: 

1. Establishing a centralized, government sponsored web page for all U.S. compa- 
nies to log on to and certify they are completely compliant. Companies could access 
this page to verify if their suppliers and customers are prepared to function after 
January 1, 2000. This would reduce duplication of effort. 

2. Immediate tax recovery of all program upgrade costs. I understand that the 
IRS has stated that the portion of any new software or hardware needed for Y2K 
compliance could be expensed in the current year. However, much of the software 
and hardware needed to operate the new upgrades will not be immediately deduct- 
ible as an expense since it is not used solely for Y2K but may incidentally improve 
other non-Y2K functions of the operating systems. This upgrade must be expensed 
over a longer period of time under the current IRS guidelines. 

3. Assure the industry that government services will be fully compliant. I under- 
stand many Federal, State, and local public bodies such as utilities, emergency serv- 
ices, financial institutions, and transportation services are not Y2K compliant and 
do not have the resources to become compliant by January 1, 2000. 

I thank you for this opportunity to express the Y2K status of our cooperative in 
Oregon. Hopefully it can help others avoid a major crises just 65 weeks from now. 


Summary of Tillamook® Cheese Y2K Issue 

Upon our February 1996 audit, of our 1995 financial records, it became apparent 
that we should begin immediately to address the potential problems in our computer 
systems when January 1, 2000 occurs. TCCA selected staff to attend Lucent semi- 
nar to gain understanding of the diverse elements that will be affected by the Y2K 
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issue (legal issues, banking and commerce, supplier compliance, and order process- 
ing). 

Our MIS staff of two people took it upon themselves to form internal teams to 
research how the Y2K issue will effect the daily operations of our company in each 
department. These teams determined that none of our major systems (Accounting 
System, Patron Payroll System, EDI Software, Payroll software, other smaller appli- 
cations, and our PBX Voice Mail system) were Y2K compliant. As a result, these 
teams evaluated and selected new applications to replace almost all major systems 
in the organization. 

MIS is also in the process of determining the general preparedness of our contacts 
in the food manufacturing industry. We have received over 10 letters of certification 
and surveys assessing the level of the problem within this entity. 

1. Research of the Y2K Crisis: 

— Gain understanding of the impact the Y2K issue will have on our network infra- 
structure, computing hardware, and major software systems 
— More specifically how will this effect plant operations (staff), customers, manu- 
facturing industry, and budget 
— Preparation of other companies 

2. Compliance Requirements: 

— Written high-level plan that outlines TCCA’s procedures for Y2K issue (include 
cost estimate) 

— Identify and schedule staff for plan implementation 
— Timetable of expected completion dates 

— Prepare comprehensive inventory of financial, informational and operational 
systems 

— Identify critical systems and decide which are negatively impacted 
— Plan for renovation, replacement and upgrade 

— Contact key vendors, service providers, and customers to determine their sys- 
tems compliance 

— Mitigation of risk of litigation and non-compliance 
— Contingency plan for systems failing to function properly 
— Delegate MIS and administration to oversee Y2K issue 

3. Year-To-Date Status 

— Selected new Windows Accounting Application (Platinum for MS SQL) and im- 
plementation has begun — conversion process expected to last through 5/99 
— EDI software upgraded to Sterling Gentran (also on MS SQL) and is ready for 
installation and implementation — completion of this process is pending on the 
interfacing Accounting system — expected to be in place by 12/98 
— Payroll software (ADP for SQL) replaced and in use since 9/98 
— Still searching for a new software application to replace Patron Payroll sys- 
tem — currently assessing Windows based system developed in New Zealand — 
expected implementation 6/99 
— Currently upgrading PBX Phone and Voice Mail system 

— On-going testing of all equipment and desktop applications for Y2K compliance 
— Currently developing three phase implementation of HMI system (Wonderware 
Factory Suite) to control and monitor the production process for all products — 
scheduled completion Fall 1999 (note that we can still make cheese if computer 
shuts down) 

— Currently assessing compliance of our suppliers, trading partners, business as- 
sociates, etc. * * * and to inform them of our plans in progress 
— Established estimated budget for implementation of plan: 


Accounting $450,000 

Patron Payroll 100,000 

EDVADP 25,000 

Earm Store 40,000 

Visitor’s Center 100,000 


Total cost 715,000 


(Cost expected to be well over a million dollars, not including staff time) 


Responses of Harold Schild to Questions Submitted by 
Chairman Bennett 

Question 1. You mentioned that you first became aware of the Y2K problem dur- 
ing your company’s February 1996 audit. Can you describe how exactly the problem 
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came to the company’s attention? What problems in your systems did you encounter 
which led you to believe there was a potential problem? 

Answer. The management letter comment was first made as part of the 1996 
audit, with the letter released in March 1997. This was becoming an automatic in- 
quiry by auditors at the time to start looking at what their clients were setting up 
for Y2K. It was a comment to mean that we, along with other companies, should 
start addressing the Y2K problem. I would assume the Y2K issue was in almost 
everybody’s management letter that year. It wasn’t really that TCCA, or other com- 
panies were oblivious to the problem, but a comment directed to boards and man- 
agement that it was an area that was going to have to be addressed. 

Question 2. You mentioned that Tillamook has been unable to attract additional 
staff to cope with your programming demands. What impact will it have on your 
Y2K readiness if you can’t obtain the needed assistance in the programming area? 
Do you have any suggestions about how to remedy this problem? 

Answer. We are looking for an additional person right now. As we talked about, 
we need to get better organized, and take care of a lot of administrative matters, 
such as documentation, Y2K compliance progress, user training and procedures, etc. 
Without that, and if we can’t get the right person, too much of what we do will be 
hit or miss, with whatever problem screams the loudest getting the most immediate 
attention. I think we probably can attract the right person, unless we run into the 
restraints of the overall company staffing budget which can be adjusted administra- 
tively. It is true that programmers are in high demand right now, and I would be 
scared if we weren’t really putting in brand new software-farm store, Wonderware, 
Platinum, retail, etc. If we were trying to rewrite everything ourselves, I don’t think 
we would ever get it done. I don’t really know how to remedy the problem. 

Question 3. What will the impact of Y2K costs be on your dairy members who are 
already struggling to keep their business viable? 

Answer. First of all, the estimated costs to TCCA as a manufacturing and market- 
ing cooperative are in the $1 million range for the fiscal years of 1998 and 1999. 
That amount will impact each of our 150 members by about $6,500 for the year. 
In a cooperative, all income that is not expended to cover operations is paid to mem- 
bers in either monthly payments for milk or year-end distribution of retained earn- 
ings. 

There is no way yet to estimate how much it will cost to evaluate and correct the 
on-farm equipment such as automated milkers, feeders, environmental systems, 
herd record keeping, or computerized automotive controls. Each farm could experi- 
ence different impacts depending on their level of electronic sophistication. 

Question 4. You rated the dairy industry as a “C” for overall Y2K preparedness. 
What evidence can you cite to support conclusion? What specific steps do you rec- 
ommend the dairy industry take to improve this rating? 

Answer. The grade of “C” was given mostly on antidotal perception. Some fellow 
dairy executives readily discuss the level of effort they have expended on the Y2K 
problem. Most, however, are reluctant to discuss the issue or they openly state skep- 
ticism that the Y2K problem is real. The higher the level of retail involvement a 
dairy has, the more likely it is to be prepared for Y2K. 

Question 5. One of your specific recommendations for the committee was that the 
Congress should establish a web page for all U.S. companies to log on to and certify 
that they were completely compliant. Assuming the U.S. Congress could accomplish 
this as a requirement for all U.S. businesses. If there were not major fines for sub- 
mitting false data and certifications, what would be the inceptive for any firm to 
submit anything other than an affirmative that they were compliant? Would you be- 
lieve the statements found at such a web site? 

Answer. If a web site were established it should include legal penalties for false 
statements. The Commerce Department could research any complaint and rule on 
the liability for misrepresentation. 

I would believe few companies would make false statements of compliance under 
the threat of legal action. In general, we do business with companies we know and 
have experienced good relations with. Those we do not know as well are now 
checked out through other companies’ experience. 

The system might not be perfect, especially if implemented in a short time frame. 
However, such a central clearing site would be preferable to not having any way 
to know if your partners in business are Y2K compliant. 


Prepared Statement of Senator Gordon Smith 

Thank you Mr. Chairman. I appreciate the opportunity to lead the effort in ad- 
dressing the business sector on Y2K issues. 
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I would like to thank all the distinguished witnesses before us today for taking 
time to testify, and for helping us address the challenges facing the entire business 
sector at both the small and large ends of the scale. And with American businesses 
today becoming more and more dependent on technology, I hope this hearing will 
be a stepping stone for all small businesses to inch closer to full preparedness for 
the Year 2000. 

Those most at risk from Y2K failures are small and medium-sized companies, not 
their larger counterparts. Many small companies have not yet realized the extent 
to which the Y2K computer problem will affect their businesses. And they may not 
have access to capital to cure such problems before the Y2K issue causes disastrous 
effects. This is why it is so important for the federal government to both raise 
awareness of the problem as well as the emerging solutions. 

In my former life, before serving as a U.S. Senator, I was a pea picker from Pen- 
dleton, and owned a small frozen food processing plant. I can assure you that any 
interruption within the farm-to-fork chain can result in not only a direct loss to 
those who supply food, but will likely translate into food shortages and price in- 
creases nationwide. As with many businesses, food suppliers are increasingly de- 
pendent on computerized processing and information exchange. 

For example, farmers and ranchers use electronically-equipped irrigation systems, 
animal systems and transport systems. Food processors rely on automated systems 
that help prepare and package consumer-ready products. Distributors, wholesalers, 
and retailers depend on computer-driven equipment to transport, deliver, store, dis- 
play, and sell food products. Inventory and accounting systems, harvesting equip- 
ment, grain elevators, refrigeration and security systems also depend on the com- 
putations of computers. 

Mr. Chairman, I am aware that in preparing for this hearing, our Committee has 
encountered some difficulties in securing witnesses from the major U.S. food retail- 
ers and manufacturers. I regret that these retailers and manufacturers cannot join 
us today. I would like to extend to them another invitation to join us next year as 
we continue to address the food industry and the important role they play in the 
world’s food market. 

However, I am happy to report that we will hear from a representative of one of 
Oregon’s food companies, many of whom have been working very hard to assure 
that they are Y2K compliant. 

I am proud to introduce Harold Schild, President and CEO of Tillamook County 
Creamery, who is one of our witnesses today from Tillamook, Oregon. I look forward 
to hearing Mr. Schild’s testimony to address the “real” problems with which a typi- 
cal small business is confronted and its approaches for addressing the Y2K problem. 

Another company from Oregon, Norpac Foods, has also been leading the efforts 
in addressing the Y2K problem in the frozen food business. While Norpac’s rep- 
resentative is not present today, the company has provided a statement to be en- 
tered into the record. 

I am very pleased to see the Deputy Administrator of the Small Business Admin- 
istration, Mr. Fred Hochberg, here before us today. The SBA has been one of the 
few leading federal agencies actively raising public awareness for Year 2000, and 
I would like to commend the agency for its aggressive outreach programs to small 
businesses. I know my constituents in Oregon have found the SBA web site very 
useful and informative. 

Mr. Hochberg, I am interested in your opinion regarding the recent legislation, 
passed by the Senate Small Business Committee, that requires the SBA to establish 
a Y2K Loan Program. I understand this loan program would establish a new short- 
term loan program under which the SBA would guarantee up to 50 percent of the 
value of private-sector loans, up to a total loan value of $50,000 for small businesses 
to become Y2K-compliant. If you or any of the witnesses can testify on the impact 
this legislation will have on tbe small businesses of America, I would be very inter- 
ested. 

As we work toward addressing the Y2K problem, let’s not forget that many of our 
international neighbors are still very far behind. We need to continue to encourage 
foreign countries to focus on the impacts of Y2K, since it could potentially shut 
down an entire country. With this in mind, I look forward to learning more about 
the specific Y2K challenges facing both our small businesses and global corpora- 
tions. 

Thank you Mr. Chairman. 
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Prepared Statement of Senator Olympia J. Snowe 

Mr. Chairman: Thank you very much for holding today’s hearing regarding how 
the year 2000 computer problem will impact small businesses. When I wrote to you 
in August, encouraging you to hold this hearing, it was after I held a series of fo- 
rums about this problem and how this problem impacts small businesses. I planned 
the forums in Maine because I felt that it was very important to bring the Year 
2000 computer problem issue to the attention to small businesses. 

I am very glad I did because I learned a lot about the problem. I learned that 
this is a very serious problem for small businesses. I learned that it will take a 
great deal of effort by the operators of the small businesses to correct this problem. 
I also learned, like most things today, a solution to this issue will require an invest- 
ment of time and money and a concerted effort to ensure that small businesses are 
aware of the problem and are encouraged to solve it now, rather than later. 

As Rod Rodrique of the Maine Manufacturing Extension Partnership will tell you 
during his testimony, the forums were an overwhelming success and people who at- 
tended learned a great deal about the problem, as I did. Mr. Chairman, I am happy 
to report that as a result of the forums, many small businesses in Maine are work- 
ing to ensure that they are Year 2000 compatible. I hope they complete the work 
on time. 

Today, as we all know, almost every aspect of our lives are influenced by comput- 
ers. Everything from bu 3 dng groceries, to phoning the office, to getting money from 
the ATM machine, all rely on the computer to process information needed to conduct 
these transactions. And certainly, just as small businesses form the backbone of our 
economy, computers have come to form the backbone of our small business oper- 
ations. 

I decided to convene these first-of-its kind in the nation forums throughout Maine 
this past August because the clock is literally ticking on our opportunity to fix the 
Y2K problem. As the last grains of sand slip through the 20th century hourglass, 
the clocks inside an estimated 200 million computers across America are counting 
down toward what could be a disaster for the country and private enterprises across 
the United States. 

We’ve all heard the humorous twist on an old saying: “Why do today what you 
can put off until tomorrow?” Well, after December 31 of next year, there won’t be 
a tomorrow for computers that, despite being able to balance multi-million dollar 
ledgers, won’t even know what day it is. In other words, instead of New Years’ being 
a time for celebration, it could be a time for consternation — and perhaps the great- 
est collective hangover this country’s ever known. 

In all seriousness, though, the impact on the small business community could be 
significant. According to a National Federation of Independent Business and Wells 
Fargo Bank study, 82 percent of small businesses are at risk. 

Fortunately, it doesn’t have to be that way. With the benefit of foresight and prop- 
er planning, we can diffuse this ticking time bomb and ensure that the business of 
the nation continues on without a hitch — or a glitch. 

From a technical standpoint, the corrections are not difficult to make. However, 
determining that there’s a problem, finding people qualified to fix the problem, and 
crafting a solution to fit the individual needs of different computers and programs 
poses significant challenges. 

For one, to determine whether a system needs to be fixed, the software code must 
be reviewed, which often entails reading literally thousands or even millions of lines 
of computer code. 

Furthermore, there is a serious shortage in this nation of workers skilled in per- 
forming this task — especially those who can decipher older computer languages 
which may no longer be taught in school, but are likely to contain the Y2K “bug”. 

Finally, there is no set method of curing the problem. A magic “one size fits all” 
solution simply does not exist, and it will be up to each individual technician to de- 
termine the proper course of action. That is why it is so important that we start 
now to fix the problem. 

On the federal level, the Senate Commerce Committee, of which I am a member, 
has been working to address the situation, which poses the threat of having a seri- 
ous negative impact on the U.S. economy over the next few years. In fact, a recent 
study by Standard Poor’s determined that, due to the Year 2000 computer problem, 
economic growth could be cut by half a percentage point in 2000 and early 2001, 
a result that would be similar to the economic damage expected from the Asian fi- 
nancial crisis. 

Major industry sectors must coordinate their efforts to correct their computer sys- 
tems so they continue to function as designed. Especially among banks, credit 
unions, and the stock market, the perils of inaction could be millions of transactions 
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lost, resulting in billions of dollars being transferred to wrong accounts, or accounts 
rendered inaccessible. 

These are important reasons not to wait another day to tackle this issue, but as 
a member of both the Commerce and Small Business Committees, back in April 
when the Commerce Committee was having a hearing on this very topic, I began 
to wonder what the effects would be on small business as well. After discussing this 
issue with people in Maine, I discovered that, in fact, small businesses were aware 
of the issue but have not focused on the problem. 

I know many small businesses simply don’t have the kind of time and resources 
that many larger businesses may have at their disposal to fix this potentially seri- 
ous problem. In order to provide small businesses assistance, I joined Senator Kit 
Bond as an original co-sponsor of legislation that will help small businesses solve 
their Y2K problems. 

Under this legislation, the Administration will establish a pilot loan guarantee 
program under which it will provide loans up to $50,000 to small businesses to ad- 
dress the issue. I believe this is a critical way in which the federal government can 
help finance the purchase or repair of computer equipment to achieve Y2K compli- 
ance. 

With that, I’d like to again thank you for holding this very important hearing. 


Prepared Statement of Ronald J. Streck 

INTRODUCTION 

Good morning. My name is Ron Streck and I am President and CEO of the Na- 
tional Wholesale Druggists’ Association (NWDA). NWDA appreciates the invitation 
to testify today before the committee about the implications of the Y2K “bug.” 

NWDA is the national trade association representing distributors of pharma- 
ceutical and related healthcare products. NWDA active member companies operate 
215 distribution centers throughout the country that service every state, the District 
of Columbia and U.S. territories. NWDA’s active members provide distribution serv- 
ices to the 130,000 pharmacy outlets in the country, including the 21,000 independ- 
ent pharmacies, 18,000 chain pharmacies, 7,500 hospital pharmacies, 220 mail order 
pharmacies, 7,000 food stores, 5,000 mass merchandisers, 4,000 long-term care and 
home health facilities, 66,000 clinics and 1,000 HMO’s. 

Our most recent data indicates NWDA-member wholesale distributors, on aver- 
age, obtain products from over 750 manufacturer suppliers. Typically, a single 
wholesale distribution center stocks an average of 24,000 items and will process 
over 13,000 order lines per day. Virtually all orders placed by pharmacy customers 
to their wholesale distributors are transmitted electronically and more and more 
“electronic” picking devices are used to fill these orders. 

To service an increasingly demanding and integrated healthcare market, prac- 
tically all wholesalers provide daily deliveries with a growing number of wholesalers 
providing twice-a-day deliveries to their customers. However, today’s wholesalers do 
so much more than “just” deliver product in a timely manner. Some of the value- 
added services NWDA members provide to their customers include marketing and 
advertising support, product sourcing programs and special handling services. Other 
services provided that are especially relevant to the Y2K discussion are the com- 
puter and information programs that include third party claims processing and re- 
ceivables services, inventory management, pharmacy computer systems for dispens- 
ing and care, and point-of-sale systems. 

Wholesalers have been innovators and leaders in information technology. They 
continue to use information technology to integrate suppliers and customers. These 
programs and systems rely on automation, connectivity, information systems, elec- 
tronic linkages and network building that allow for the prompt and efficient delivery 
of life saving healthcare products. NWDA members have been methodically working 
to ensure their systems and those of their customers are compliant. You will hear 
more about exactly what wholesalers have been doing from Keith Mallonee of the 
McKesson Corporation in a few minutes. 

Based on the number of suppliers, customers and orders, it does not take long to 
speculate on what would happen if there were an interruption of electronic transfer 
of information. Many of these transmissions are reliant on commercial and govern- 
ment telecommunication networks — systems over which the pharmaceutical indus- 
try has no control. NWDA and its members need to know that these vital commu- 
nication networks are Y2K compliant and ready to support the delivery of 
healthcare services to the patient. This constant electronic transfer of information 
is the reason I am here today. 
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NWDA and our members have long been concerned with the potential for Y2K 
problems. This topic was first discussed in 1993 when the association began an ini- 
tiative to raise awareness of the problem in the industry and develop a plan of ac- 
tion. In the subsequent years, NWDA’s Technical Standards Committee, Productiv- 
ity Committee, and Business Systems Committee have addressed the issue and it 
has been highlighted numerous times in the association’s newsletter. NWDA staff 
have been active participants in the process that developed Y2K standards among 
EDI standards’ groups and in the adoption of Year 2000 compliance standards re- 
quired under the Health Insurance Portability and Accountability Act. In addition, 
NWDA’s long-range strategic plan includes a specific goal to “set up a system to 
share information on solutions to the Y2K problem by 1998.” 

As we have developed our association’s webpage, NWDA has devoted a separate 
section just for dissemination of general Y2K information. We endorse the notion 
of common solutions for common process problems and we are ready to move ahead 
with an industry clearinghouse for Y2K technical fixes that would allow drug whole- 
sale trading partners to freely share such technical information. We have been re- 
luctant to proceed with this project due to liability and antitrust concerns. However, 
with the passage of the Year 2000 Information and Readiness Disclosure Act (S. 
2392) we understand that we will now be able to move ahead. We commend Con- 
gress for its approval of this important legislation and urge the President to move 
swiftly to sign the bill into law. 


CONCERNS 

We are greatly concerned that federal, state and local governments are quickly 
running out of time to adequately test and correct all public service and infrastruc- 
ture systems. It is disturbing to read reports from Congress and the General Ac- 
counting Office indicating that there are serious concerns that many federal agen- 
cies will not be ready. The July 1998 report by the GAO entitled ‘Wear 2000 Com- 
puting Crisis” concluded that “federal agencies and state governments suggest that 
the full extent of the managerial and operational challenges posed by the heavy reli- 
ance on others for data needed to sustain government activity is not yet known.” 

Congressman Steve Horn, in his role as chairman of the House Subcommittee on 
Government Management, Information and Technology, has issued another report 
card on federal agencies with HCFA once again receiving an “F.” We fear that fed- 
eral and state government agencies will not survive the change over to Year 2000 
without interruptions in healthcare reimbursements. Let me explain the impact a 
failure in the Medicare/Medicaid programs could cause in the delivery of prescrip- 
tion drugs. 

Wholesalers operate on very low profit margins (1997 figures show a net profit 
after taxes of 0.76 percent) and extend credit to their customers who also operate 
on very tight margins. Over 75 percent of prescription drugs are reimbursed 
through various third party and government programs. Pharmacies and hospitals 
purchase products on credit with the expectation that there will be a continual flow 
of reimbursement to offset these expenses. If prescription drug reimbursements for 
their Medicaid and Medicare patients should be interrupted for any length of time, 
we are concerned that many retail pharmacies and rural hospitals will not be able 
to weather the storm. 

A related concern is the emerging role wholesalers have recently taken to manage 
their customer’s receivables. Wholesalers, as part of their customer service program, 
will buy the receivables from their pharmacy customers and pay them within three 
days. Typically, the wholesaler must then wait 30 to 90 days to be reimbursed by 
the third party payer. If the government or other payers are not Y2K compliant, 
it will seriously imperil the cash flow for the wholesalers and their customers. 

Government reimbursement is only one area that could disrupt the flow of life 
sustaining prescription drugs to patients. Even if all parts of the prescription drug 
supply chain are compliant and ready, if there are failures in other links, it would 
be irrelevant that we are ready. We need assurances that government agencies will 
be Y2K ready so they can seamlessly carry out their important functions. If they 
are not, and drug wholesalers therefore cannot provide pharmaceuticals to the phar- 
macy or hospital when they are needed, the results could be catastrophic. Addition- 
ally, failures within the transportation, communications, public utility or financial 
networks will have a great impact on our sector. All these systems are inter- 
connected and disruption in one causes disruption throughout the entire system. 

We are hearing that patients and providers are starting to talk about trying to 
stockpile products as a contingency plan. This is not a realistic approach and one 
that could prove to be very dangerous to the patient. Not only are there cost and 
efficiency concerns, but more importantly, there are safety and efficacy issues re- 
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volving around the integrity of the product due to expiration dates and sensitive 
storage requirements. In addition, if a DEA registrant suddenly increased its nor- 
mal ordering pattern for controlled substances, a “suspicious order” report would be 
generated and investigation of these events would put an unnecessary and avoidable 
drain on law enforcement resources. Also, many patients are prohibited under their 
insurance plans from obtaining more than a 30-day supply of their prescription. 
Clearly, stockpiling or hoarding prescription drugs is not the answer. 

CONCLUSION 

Wholesalers are making contingency plans to make sure there is not a disruption 
in the availability of product. I want to emphasize that wholesalers are just one link 
in the chain. If the government agencies that play such a vital role in the health 
care system are not going to be Y2K compliant, contingency plans must be quickly 
completed and this information passed on to the public. How a business or industry 
develops its own backup plan depends on what government services will be avail- 
able. NWDA and our member companies stand ready to work with government, at 
all levels, to address these issues to ensure that life saving medicines continue to 
get to those who need them when they need them. Time is of the essence. I thank 
the Committee for holding this hearing today to address this momentous issue. 


Responses of Ronald J. Streck to Questions Submitted by 
Chairman Bennett 

Question. Mr. Streck, even though your industry deals with 760 pharmacy suppli- 
ers and 130,000 outlets in the country, you rate government agencies as one of your 
top Y2K concerns. Will you please tell the Committee which government agency you 
are most concerned about and why? 

Answer. Government agencies are not our only concern. For example, we are con- 
cerned about the Y2K readiness of our trading partners, pharmacy customers, util- 
ity companies and telecommunication networks. However, we continue to hear re- 
ports from the GAO and others that numerous government agencies are behind in 
their efforts to become Y2K compliant. 

We are concerned that HCFA will not be ready. Indeed, in a September 1998 re- 
port, the GAO concluded that “Despite its actions to improve the direction and over- 
sight of the Y2K effort, HCFA’s Y2K progress is significantly behind schedule.” 
HCFA concerns us because of the impact a disruption in the reimbursement sched- 
ule would have on pharmacy providers participating in the Medicare and Medicaid 
programs. It could be especially devastating for small retail pharmacies. The ripple 
effect on drug wholesalers could also be dramatic due to the emerging role they are 
taking in managing their customer’s receivables. As discussed in my testimony, 
“Wholesalers, as part of their customer service program, will buy the receivables 
from their pharmacy customers and pay them within three days. Typically, the 
wholesaler must then wait 30 to 90 days to be reimbursed by the third party payer. 
If the government or other payers are not Y2K compliant, it will seriously imperil 
the cash flow for the wholesalers and their customers.” 

Another federal agency that has a significant impact on drug wholesalers is the 
Drug Enforcement Administration (DEA), due to its oversight responsibilities in 
tracking controlled substances. Drug wholesalers need reassurance that DEA’s sys- 
tems will be prepared to deal with the Y2K problem and that there will not be a 
disruption in the distribution of controlled substances. Because drug wholesalers re- 
ceive and distribute products via the nation’s highways, we are also concerned that 
the systems related to this are compliant. It is very disturbing to read in a GAO 
report (March 1998, GAOAr-AIMD-98-101) that “highway safety could be severely 
compromised because of potential Year 2000 problems in operational systems.” 

The readiness of state agencies that administer programs that complement or par- 
allel federal programs are also of concern. For example, if HCFA were Y2K compli- 
ant hut the state agency that administers the Medicaid program is not, there will 
be disruptions. 

Finally, I want to clarify one of the numbers cited in the question — on average, 
a wholesaler will deal with 750 suppliers; overall, there are approximately 2,000 
such suppliers in the country. 

Question. Please explain to the Committee how the Drug Enforcement Agency 
(DEA) becomes involved if patients or providers stockpile drugs in anticipation of 
the Y2K problem? 

Answer. The DEA is responsible for monitoring the distribution of controlled sub- 
stances. As you know, these drugs are particularly susceptible to abuse and there- 
fore the oversight is strict. For example, the DEA, through the U.S. Attorney Gen- 
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eral, sets an annual production quota for Schedule I drugs (high potential for abuse, 
no accepted medical use, used primarily in research settings) and Schedule II drugs 
(high potential for abuse, acceptable medical use with severe restrictions, abuse may 
lead to severe psychological or physical dependence). While stockpiling of Schedule 
I’s is very unlikely, it could happen more readily with Schedule II drugs. Based on 
the quota amounts, which are established in the preceding year, orders by manufac- 
turers for ingredient quantities are placed, production schedules are set, etc. well 
in advance of the time the product reaches the marketplace. If stockpiling does 
takes place toward the end of 1999, manufacturers will not be able to meet the 
needs of those patients who did not hoard and their lives will be in danger. 

Under the supervision of DEA, there is also a highly regulated method for track- 
ing controlled substances through the supply chain. When there is a significant 
change in ordering patterns or an unaccounted for variance, it is the obligation of 
the drug wholesaler to report this “suspicious order” to DEA. DEA then has the pre- 
rogative to investigate. It is our concern that if there were a marked change in or- 
dering patterns in the final months of 1999, the DEA would have to expend signifi- 
cant resources to investigate. 

I would like to reiterate that I do not believe that stockpiling is the answer. There 
are safety, efficacy, storage and waste issues that must be considered. As discussed 
in the next question, now is the time for health care providers and patients to be 
discussing alternatives to insure that necessary medications are available if Y2K 
problems result in a disruption of the regular supply channel. 

Question. Does the wholesale drug industry have any plans to provide an emer- 
gency supply of drugs to people like Laurene West who will perish without them? 

Answer. Virtually all drug wholesalers have contingency plans to deal with emer- 
gency situations. They have a history of providing life saving medications even when 
floods, earthquakes, hurricanes and other natural disasters have disrupted the nor- 
mal flow of product. I am proud of the responsiveness and creativity of our industry 
in these situations. Ms. West should be commended for her proactive stance and rec- 
ognized for raising important concerns. As always, drug wholesalers are ready to 
work with health care providers and their patients, who are especially dependent 
upon pharmaceuticals to maintain life, to have ready access to them. It is incumbent 
upon those providers and patients to be working together now to develop contin- 
gency plans should the Y2K “bug” alter the normal means of obtaining the nec- 
essary drugs. 

Question. Would you please explain to the Committee your industry’s plan for a 
web page for an industry clearinghouse for Y2K technical fixes? 

Answer. NWDA established and maintains on our website a centralized page of 
links that provides industry-specific Y2K information. With the passage of the Year 
2000 Information and Readiness Disclosure Act, we will be enhancing the site to in- 
clude a list server and discussion forum for members to share appropriate Y2K in- 
formation and solutions. It is my hope that we will be “up” in the next 30 to 45 
days. Once it is operative, a major effort will be undertaken to publicize this re- 
source to our membership. 

Additionally, I am pleased to let the committee know that NWDA may be working 
with the Pharmaceutical Research and Manufacturers Association (PhRMA), the na- 
tional association representing our country’s pharmaceutical manufacturers, to fa- 
cilitate dialogue between our respective members on this topic. We have just begun 
our discussions on this project and it may expand to include all segments of the 
pharmaceutical supply chain. 

Question. Mr. Streck, you have stated that the constant transfer of information 
is the reason you are here today. Have you contacted the major telecommunication 
companies to tell them of your concerns and obtain reassurance that they will be 
operating on January 1, 2000? 

Answer. The telecommunications sector touches virtually everyone in our country. 
It is my hope that Congress has sent a strong message to this industry that it is 
essential that it be Y2K ready on January 1, 2000. 


Prepared Statement of Laurene L. West 

Standing here before you this morning I probably appear to be in good health. 
I am not. Without daily medication and a coordinated effort from the health care 
community, I will be a casualty of the Year 2000 — I will die. 

I had a tumor removed from the center of my brain and now I require daily medi- 
cation to prevent re-growth. Additionally, when I had the first of 13 surgeries on 
my head, I acquired a staph infection which does not respond to any known oral 
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antibiotic. I am dependent on IV antibiotics which I can not stockpile as they expire 
in less than 30 days. A disruption to the supply of IV antibiotics will kill me. 

I am a Registered Nurse — for more than 20 years I have worked in Critical Care 
areas of the hospital. Concurrently for the past 14 years, I have worked to develop 
and implement medical information systems. For the past two years I have worked 
with various health care organizations to help them prepare for the Year 2000 cri- 
sis. 

I know health care. I know what impact the Year 2000 will have on healthcare. 

My message today is two fold * * * 

First — we have all read media reports expressing concern about potential power 
outages in the Year 2000 and the resulting effect on national security, financial in- 
stitutions, air traffic control, etc. * * * all hospitals and health care facilities will 
be at significant risk without power. However, today, I want to suggest that a dis- 
ruption in the medication supply will be more important than a disruption to the 
power supply. Nurses can keep patients alive with manual procedures — doing CPR 
for extended periods of time but we can not keep patients alive without medications. 

The second message is that all Americans will be affected if there is a disruption 
in the supply and distribution of medications, particularly for those of us who are 
alive only because we have uninterrupted access to prescription medications. 

Ladies and Gentlemen, my medications requirements are minimal compared to 
those of many other Americans. Millions of insulin dependent diabetics, cardiac pa- 
tients, transplant patients (kidney, heart, lung, cornea — all organs) will die if their 
medication requirements are not met. 

We need to begin immediately to teach the American public what they can do to 
prepare. We need a massive, national public awareness/education program so that 
we can minimize the number of Year 2000 related casualties. An informed and edu- 
cated public will be less likely to panic * * * causing social unrest because prescrip- 
tion drugs are not available. 

All medication dependent Americans are looking to you to help mobilize national 
resources to help us survive. I want to help with this process, all I need are funding 
and your influence. 

Let’s work with the RX2000 Solutions Institute, health care organizations rep- 
resented in this room, the American Medical Association, AARP, The International 
Red Cross, as well as federal resources to develop plans for a coordinated national 
preparedness program so that the Year 2000 does not cause unacceptable risks. 

We need legislation allowing for a one time exclusion for Medicare or health plans 
allowing patients to receive a 90 day supply of medications instead of a 30 day sup- 
ply. We need creative processes for distributions of controlled substances and radio- 
active isotopes. (All health plans should volunteer this option.) Just in time inven- 
tory is a big problem 

Pharmaceutical companies — should be pressuring AMA, AHA, ANA, DOI to allow 
for this exclusion * * * may loose 50-70 percent of their client base by Q1 2000). 

We need to work with the CDC (Center for Disease Control) to prevent global 
epidemics from a lack of antibiotics or immunizations. 

We should compose a National “Patient Advocacy Council” to monitor Y2K efforts 
within all health care organizations. This could be an attachment to the RX2000 In- 
stitute. (I would like to chair this committee.) 

Health care organizations should be required to stockpile medications and sup- 
plies as well as disclose their Y2K compliance progress with their patient popu- 
lation. 

And, if worst case scenarios do occur, and health care is rationed, the public needs 
to know what procedures and diagnoses will be treated. 

Thus far, most health care organizations have taken the stance that their liability 
exposure can be limited by keeping “in check” their due diligence efforts. (This may 
be politically and legally correct but I do not consider this to be ethical.) If WE do 
not teach the public, who will? There is no harm if we over react, many may die 
if we do not act. 

I am willing to do whatever I can to help save as many lives as possible — mine 
included. My story is not unique, there are millions of people who know there is 
a problem but they do not know where to turn for suggestions or help. Let’s help 
them. 



ADDITIONAL MATERIAL SUBMMITTED FOR THE RECORD 


NORPAC Foods, Inc., 

Stay ton. Or, October 5, 1998. 

Hon. Gordon Smith, 

U.S. Senate, 

Washington, DC. 

Dear Senator Smith: It is a privilege to respond to your request for information 
about how NORPAC Foods, Inc., Oregon’s largest fruit and vegetable processor, is 
addressing Year 2000 (Y2K) issues. 

As a large food processor, we are addressing Y2K issues to meet two long-range 
goals and specific near-term business objectives. 

First, our actions are guided by our commitment to maintain and improve the 
critical trust relationship we have with our consumers at every level of our distribu- 
tion process. This includes our 240 owner-growers, more than 4,000 employees, 
countless suppliers, and the citizens in the communities throughout Oregon where 
our facilities are located. Our public holds us to a critical standard and we take that 
responsibility very seriously throughout every level of our organization. 

We have placed Y2K compliance in this trust category because of the critical 
interdependence NORPAC has with so many people, and the scores of inside and 
outside company business functions that are served by our computer system. There 
is the continuous expectation that both the quality and access to information, and 
how we and others use it, must not be adversely affected. 

Second, we are a highly regulated business operating in an industry that must 
continue to meet many stringent standards established by federal, state or local gov- 
ernments, or the specific operating agreements we have with our growers, suppliers 
or vendors. 

Recognizing these two trust goals and our primary operational objective to ensure 
that the goods and services we provide will flow without interruption as we move 
into the next century, we established our formal Y2K Project in 1997. This multi- 
phase process has been implemented throughout every level of our company, with 
the ongoing support of our board of directors. 

While you will find a more specific description of our plan attached to my letter, 
here is a summary of our actions. 

Our initial and primary operational focus has been on our own internal computer 
system. This system integrates the operation of our company across five geographi- 
cally dispersed locations and through shared business relationships with many other 
businesses outside of NORPAC. We have brought our information systems depart- 
ment together with plant operations and engineering to look at both common and 
specific issues and solutions. 

Earlier this year, we required that any new software systems, whether developed 
internally or purchased externally, be Y2K compliant. To raise expectations with our 
suppliers and external business partners about NORPAC’s standards, we sent a let- 
ter and readiness survey to prompt them to take appropriate actions. 

These actions have resulted in a detailed assessment of where we are, particularly 
with our progress on coding changes to our own systems. Before the end of this year, 
we will have completed all testing and verification to ensure that our software 
changes are Y2K compliant. 

Operationally, we are working to identify, assess and develop responses to prob- 
lems in outside-manufactured processing equipment. This effort has been challeng- 
ing, as suppliers are presenting a declining level of information about whether this 
equipment has time-dated chips. Ultimately, this will impact our re-packing of 
stored fruits and vegetables into ready-to-market consumer products, and the trans- 
portation and tracking of them more than one year from now. 

Despite the fact that we have made a significant investment in information about 
the Y2K issue, and developed and implemented a very thorough and comprehensive 
response, many uncertainties remain. 
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The issues are larger than what will happen from a data processing or operational 
standpoint when we enter the new millennium. For example, what will our un- 
known legal exposure be? Where will a company like NORPAC be, who has made 
a very thorough effort to meet this problem, who then finds itself exposed to pres- 
ently undefined legal liabilities? 

We would encourage Congress, under your leadership, to craft some appropriate 
“firewall” legislation to acknowledge and protect those organizations, like NORPAC, 
who have made significant efforts to ensure Y2K compliance. 

Senator Smith, from your own knowledge of the food processing business, you 
know that all of us take these issues very seriously. Because we are a food proc- 
essor, we may hold ourselves to a standard of public trust that is unique, but we 
are not asking for unique protection. 

Rather, we would encourage you and the Congress to look for ways to clearly ac- 
knowledge Y2K compliance, and provide every American business with an assurance 
that their efforts have created a foundation for the future not a springboard for a 
decade of unanticipated litigation. 

In the spirit of sharing information about this important issue and reaching solu- 
tions to common problems, please look to NORPAC Foods as a participant with Con- 
gress and other interested parties. If you, or your distinguished colleagues, have any 
questions, please call me. 

Thank you for your continuing leadership. 

Sincerely, 


Rick Jacson, 
President and CEO. 


NORPAC Foods, Inc. Action Summary 

— What is the issue? (1) 

—What is our OBJECTIVE? (2) 

— How did we get started and what have we done? (3) 

— Where are we now? (4) 

— What areas are there where there might be exposure? (5) 

(1) THE ISSUE 

Simply stated, computers (where ever they are used) may have a problem func- 
tioning January 1, 2000, due to a defect in date identification. Given our exposure, 
we needed to identify where we use computers and then ensure that the date issue 
will not negatively impact our operations. 

(2) OUR objective 

NORPAC views Year 2000 compliance as a company-wide issue and has a serious 
commitment to ensure that goods and services we provide will flow without inter- 
ruption as we move to the next century. 

A major activity has been to ensure our computer systems will function without 
interruption. We have involved Plant Operations and specifically, our Engineering 
Department to review all of our processing capabilities for compliance with the year 
2000 issue. 


(3) HOW DID WE GET STARTED AND WHAT HAVE WE DONE? 

NORPAC established a formal Year 2000 Project in 1997. Awareness of the Y2K 
problem was communicated to all areas of the company, as well as the Board of Di- 
rectors. Since 1997, our Information Systems Department has required that any 
new systems, whether internally developed or acquired from software vendors, are 
Year 2000 compliant when delivered. In early 1998 NORPAC encouraged its suppli- 
ers to take appropriate action as well. In February 1998, a letter and survey was 
sent to all NORPAC suppliers and external business partners. The goal was to raise 
awareness of NORPAC’s expectations with its suppliers, to determine their readi- 
ness with the Y2K issues and to gain their commitment that they will be Year 2000 
compliant. 


(4) ASSESSMENT (WHERE ARE WE NOW?) 

INFORMATION SYSTEMS: At this point we have done an extensive assessment 
as to the Y2K impact on our computer system processes. This includes our software 
(in-house developed or purchased), our computer hardware (both company comput- 
ers and personal computers), and our data communication capabilities (including 
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EDI standards). We are rapidly completing the “coding” changes to our computer 
systems to make them Y2K compliant. We are now entering a testing phase, where 
all software changes need to be tested and verified. This is a critical and fairly 
lengthy process. We want to complete this effort, if at all possible, by the end of 
this year. 

OTHER AREAS: As a food processor we have extensive processing equipment in 
our plants. Much of this equipment uses micro processors and PLC’s (programmable 
logical controllers) to monitor and control the processing. Fortunately, for us there 
is very little date manipulation. We also have the advantage that most of the control 
processors have manual override capability. We have concluded that our exposure 
in this area is very limited, and we have not had to conduct any rigid verification 
and testing procedures. 

(5) exposure/concerns 

There are areas where we simply do not know if we will have a problem. These 
areas lie outside our control (power, transportation, banking systems). However, 
these “gray” areas do require us to be attentive to any information about the poten- 
tial problems that might negatively impact us. This will be an on-going process up 
until 01/01/2000. 

The INTERNET continues to provide a wealth of this information. We expect that 
Federal and State government will continue to provide information as well. We have 
already met with our local city government and with the state’s Y2K Project Leader. 
Issues like electrical power availability are now being discussed. It appears that 
complete assessment of exposure in many of these areas is still underway. As new 
information presents itself, and this creates concern for us on our company’s ability 
to carry on our business operation, contingency plans will need to be made more 
formal. This is an area that can impact us all; the private citizen, business or gov- 
ernment. It seems appropriate that an information sharing initiative be established 
(whether that be on the INTERNET, town hall meetings or other formats). 
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